CVE-2026-116067: falha de alta gravidade em ananthakumaran paisa
Paisa before 0.7.8 Path Traversal via Editor and Sheet API
Publicada em
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 8.8epss 1.7%
probabilidade de exploração
1.7%top 23% das CVEs
exploração observada
nãonenhuma fonte reporta
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ananthakumaran · paisaReferências
https://github.com/ananthakumaran/paisahttps://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31https://github.com/ananthakumaran/paisa/issues/420https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api