CVE-2026-116067
HIGH
8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: none
Description
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
StableCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Modify Files Or Directories
Read Files Or Directories
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
AI/ML
https://github.com/ananthakumaran/paisa
https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L…
https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4…
https://github.com/ananthakumaran/paisa/issues/420
https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8
https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-edit…