CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
CVSS
7.4
Alto
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Publicado: 13 ago 2026 · Última mod.: 14 ago 2026 · CWE-22
0.3%EPSS · 30 días0.3%
2026-08-142026-09-06
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-865429.1 CRÍ—
———knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.10hCVE-2026-865418.3 ALT—
———knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.10hCVE-2026-865387.5 ALT—
———knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.10hCVE-2026-864398.8 ALT—
———knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.10hCVE-2026-63777.5 ALT—
———Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal.
This issue affects CSM (Customer Service Management): from 6.8.9 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.18hCVE-2026-801317.4 ALT—
———Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.19h