CVE-2026-88394

{
  "etk_id": "ETK-2026-656",
  "cve_id": "CVE-2026-88394",
  "display_id": "CVE-2026-88394",
  "ghsa_id": "GHSA-2wmx-vpxq-f7g7",
  "euvd_id": "EUVD-2026-92442",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Directory traversal in WookTeam task export",
  "summary": "WookTeam 1.6.6 and earlier are affected by a directory traversal issue in the project task export API. An attacker able to submit requests to that endpoint may obtain files accessible to the web server process by causing the export operation to reference paths outside its intended storage area.",
  "mitigation": "Restrict or disable access to the project task export endpoint, limiting it to trusted users and networks, until a corrected release is available. Review web-server account permissions to reduce the files that could be exposed.",
  "vendor": null,
  "product": "WookTeam",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0057,
  "epss_percentile": 0.4618,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 80.01742021666666,
  "t0_at": "2026-10-05T00:00:00+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T00:00:00+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88394"
    }
  }
}