CVE-2026-110889

{
  "etk_id": "ETK-2026-1888",
  "cve_id": "CVE-2026-110889",
  "display_id": "CVE-2026-110889",
  "ghsa_id": "GHSA-x2rj-ccg3-p58p",
  "euvd_id": "EUVD-2026-103283",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Sensitive error-message disclosure in Gantry 5 Framework",
  "summary": "Gantry 5 Framework installations using gantry5 through version 5.6.4 may expose embedded sensitive data in error messages. An unauthenticated attacker may retrieve that information when they can reach an affected installation over the network.",
  "mitigation": "Restrict public access to affected Gantry installations and avoid exposing detailed error output. Monitor for a vendor update and upgrade promptly when a fixed release is published.",
  "vendor": "Gantry",
  "product": "Gantry 5 Framework",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.6.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "gantry5",
      "purl": null
    }
  ],
  "cwes": [
    209
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0034,
  "epss_percentile": 0.2626,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 17.631385233333333,
  "t0_at": "2026-10-17T11:00:12.190000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T14:58:37.643004+00:00",
      "days": 0.16557237273148148,
      "is_lower_bound": false,
      "measured_at": "2026-10-17T11:00:12.190000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-17T11:00:12.190000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-17T11:00:12.190000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110889"
    }
  }
}