CVE-2026-103508

{
  "etk_id": "ETK-2026-1899",
  "cve_id": "CVE-2026-103508",
  "display_id": "CVE-2026-103508",
  "ghsa_id": "GHSA-m6jx-f652-pc27",
  "euvd_id": "EUVD-2026-102074",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in P4 Search logging configuration",
  "summary": "P4 Search 2026.4.2 and earlier can mishandle administrator-supplied logging settings, allowing file operations outside the designated log directory. An authenticated administrator of the connected P4 Server could potentially cause code to run with the P4 Search service account's privileges.",
  "mitigation": "Upgrade P4Search to version 2026.4.3 or later. Until upgrading, restrict P4 Server administrative access and review logging-configuration changes.",
  "vendor": "Perforce",
  "product": "P4 (Helix Core)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2026.4.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.4.3"
      ],
      "package_name": "P4Search",
      "purl": null
    }
  ],
  "cwes": [
    23
  ],
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
  "epss_score": 0.0042,
  "epss_percentile": 0.3556,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 74.31748361666666,
  "t0_at": "2026-10-15T14:02:19.129000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T19:39:07.771180+00:00",
      "days": 2.233896321527778,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T14:02:19.129000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T14:02:19.129000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T14:02:19.129000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103508"
    }
  }
}