CVE-2026-94238

{
  "etk_id": "ETK-2026-590",
  "cve_id": "CVE-2026-94238",
  "display_id": "CVE-2026-94238",
  "ghsa_id": "GHSA-m23q-3295-mh2g",
  "euvd_id": "EUVD-2026-91947",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file read in Loco Translate",
  "summary": "Loco Translate versions before 2.8.9 allow translation-file routes to access certain file types from locations outside the web root. An attacker must have the plugin's translator capability and could retrieve eligible files from elsewhere on the server.",
  "mitigation": "Update Loco Translate to version 2.8.9 or later. Restrict the translator capability to trusted users until the update is complete.",
  "vendor": null,
  "product": "Loco Translate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.8.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.8.9"
      ],
      "package_name": "Loco Translate",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 6.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": 0.0032,
  "epss_percentile": 0.2315,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 49.68984258333333,
  "t0_at": "2026-10-03T06:00:27.699000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T21:46:42.832488+00:00",
      "days": 1.6571196005555555,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:27.699000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T06:00:27.699000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:27.699000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94238"
    }
  }
}