CVE-2026-5027 - Vulnerability Analysis

Overview

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.

Severity & Score

Impact

Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.

Mitigation

Sanitize the 'filename' parameter to prevent path traversal or update to the latest secure version.

References

• https://www.tenable.com/security/research/tra-2026-26

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner