CVE-2026-67449

{
  "etk_id": "ETK-2026-4225",
  "cve_id": "CVE-2026-67449",
  "display_id": "CVE-2026-67449",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Unauthenticated path traversal in Portabase TUS uploads",
  "summary": "Portabase versions earlier than 1.21.2 contain a path traversal issue in the TUS upload webhook handler. An unauthenticated attacker able to reach that handler can overwrite files in Portabase's private data directory, potentially including the encryption master key.",
  "mitigation": "Upgrade Portabase to version 1.21.2 or later. Restrict access to the TUS upload webhook until the upgrade is complete.",
  "vendor": "Portabase",
  "product": "portabase",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.21.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.21.2"
      ],
      "package_name": "portabase",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-11T21:51:23.105000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T21:51:23.105000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T21:51:23.105000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67449"
    }
  }
}