CVE-2026-116067highCWE-22

CVE-2026-116067: fallo de gravedad alta en ananthakumaran paisa

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

Publicada el

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.8epss 1.7%
probabilidad de explotación
1.7%top 23% de las CVE
explotación observada
noninguna fuente lo reporta
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
ananthakumaran · paisa
Referencias
https://github.com/ananthakumaran/paisahttps://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31https://github.com/ananthakumaran/paisa/issues/420https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api