CVE-2026-63162
8.8HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
Authenticated attackers can write arbitrary files to the server and achieve remote code execution. They only need network access and low-privileged user credentials to exploit the file upload parameter.
Root cause
The application fails to sanitize or anchor the user-supplied tmpFolderName parameter during file uploads, permitting directory traversal sequences outside the temporary folder.
Affected systems
Omnispace Agora Project versions prior to 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If patching immediately is not possible, restrict untrusted user access to file upload features or place Agora Project behind a WAF configured to block directory traversal sequences in POST parameters.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.