CVE-2026-116067

{
  "etk_id": "ETK-2026-2596",
  "cve_id": "CVE-2026-116067",
  "display_id": "CVE-2026-116067",
  "ghsa_id": "GHSA-c69r-vcvw-qgm3",
  "euvd_id": "EUVD-2026-109381",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Paisa file and backup handlers",
  "summary": "Paisa versions before 0.7.8 are affected by path traversal in file and backup handling endpoints. An unauthenticated attacker can read files accessible to the server or delete backup files outside the intended journal or sheets directories by supplying crafted file names.",
  "mitigation": "Upgrade paisa to version 0.7.8 or later. Restrict access to the affected editor and backup endpoints until the update is applied.",
  "vendor": "ananthakumaran",
  "product": "paisa",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.7.8"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.7.8"
      ],
      "package_name": "paisa",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.681651916666667,
  "t0_at": "2026-10-25T11:50:56.480000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-25T11:50:56.480000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T11:50:56.480000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116067"
    }
  }
}