CVE-2026-28676highCWE-22

CVE-2026-28676: falha de alta gravidade em OpenSift

OpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OpenSift

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
OpenSift · OpenSift
CVEs relacionadas — OpenSift

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27169HIGHOpenSift: Persistent XSS Chat Tool RenderingEPSS 0.4%CVE-2026-28677HIGHOpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal accessEPSS 0.3%CVE-2026-28675MEDIUMOpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpointsEPSS 0.3%CVE-2026-27170HIGHOpenSift: SSRF risk in URL ingestion endpointEPSS 0.2%CVE-2026-27189MEDIUMOpenSift: Race-prone local persistence could cause state corruption/lossEPSS 0.1%