CVE-2026-79706mediumCWE-434

CVE-2026-79706: medium-severity vulnerability in Breeze Cache

Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal

Published

Follow this CVE+ Monitor Breeze Cache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Breeze Cache
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Breeze Cache

In the same product, most dangerous first.

CVE-2026-79713MEDIUMBreeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersEPSS 0.3%CVE-2026-10551MEDIUMBreeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify LibraryEPSS 0.3%