CVE Watch10 de nov. de 2026

CVE-2026-125390

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUpl

CVSS

6.5

Média

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-36

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1073319.9 CRÍ

43.0%

——13IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.2d CVE-2026-1236196.8 MÉD

40.7%

——12Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.4d CVE-2026-1166356.1 MÉD

24.4%

——7Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1.4d CVE-2026-1186934.7 MÉD

3.5%

——1CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.7d CVE-2026-837848.8 ALT

65.4%

——20Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.12d CVE-2026-837468.1 ALT

67.0%

——20Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.28d