CVE-2026-112244

{
  "etk_id": "ETK-2026-3460",
  "cve_id": "CVE-2026-112244",
  "display_id": "CVE-2026-112244",
  "ghsa_id": "GHSA-v2q9-hw4w-2v6m",
  "euvd_id": "EUVD-2026-116723",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated path disclosure in Duplicator PHP files",
  "summary": "Duplicator and Duplicator Pro versions before 5.1.0 expose certain bundled PHP files to direct requests. An unauthenticated attacker may trigger error output that reveals absolute filesystem paths when the affected files are accessed outside their expected context.",
  "mitigation": "Upgrade Duplicator or Duplicator Pro to version 5.1.0 or later. Restrict direct web access to bundled PHP files until the update is applied.",
  "vendor": null,
  "product": "Duplicator",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.1.0"
      ],
      "package_name": "Duplicator",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.1.0"
      ],
      "package_name": "duplicator-pro",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 25.21636965,
  "t0_at": "2026-11-04T06:00:26.085000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T06:46:37.492660+00:00",
      "days": 0.0320764775462963,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:26.085000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-11-04T06:46:37.492660+00:00",
      "days": 0.0320764775462963,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:26.085000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T06:00:26.085000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:26.085000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112244"
    }
  }
}