CVE-2026-113402

{
  "etk_id": "ETK-2026-2235",
  "cve_id": "CVE-2026-113402",
  "display_id": "CVE-2026-113402",
  "ghsa_id": "GHSA-4v9g-qvqj-2jr7",
  "euvd_id": "EUVD-2026-104809",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal file inclusion in ArmorX Spam",
  "summary": "ArmorX Spam is affected by a file inclusion flaw involving insufficient path handling. A remote attacker with valid authentication may cause the application to load PHP files from outside its intended directory; unauthenticated attackers are not described as affected by this issue.",
  "mitigation": "Restrict ArmorX Spam access to trusted, authorized users and remove unnecessary public exposure while awaiting vendor remediation. Review authenticated accounts and permissions to reduce the number of users able to reach the affected functionality.",
  "vendor": "ArmorX Global Technology",
  "product": "ArmorX Spam",
  "affected": [
    {
      "affected_notes": [
        "ArmorX Spam versions prior to 8.15.2-3.282.133-1.90.061"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ArmorX Spam",
      "purl": null
    }
  ],
  "cwes": [
    98
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.632832133333332,
  "t0_at": "2026-10-20T06:28:45.554000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T06:28:45.554000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T06:28:45.554000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113402"
    }
  }
}