{"id":"CVE-2026-63162","published":"2026-10-13T20:17:31.687","lastModified":"2026-10-15T15:52:40.503","description":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]},{"url":"https://www.agora-project.net/","tags":[]},{"url":"https://www.vulncheck.com/advisories/omnispace-agora-project-path-traversal-via-tmpfoldername-parameter","tags":[]}],"exploitRefs":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal vulnerability in Omnispace Agora Project allows attackers to write arbitrary files outside the intended temporary directory by manipulating the tmpFolderName parameter. This can lead to remote code execution by placing malicious files in critical system locations.","exploitability":"The vulnerability is relatively easy to exploit as it requires only a single HTTP request with a crafted tmpFolderName parameter, with no additional authentication needed beyond basic access to the upload endpoint.","blast_radius":"If exploited, this flaw could allow attackers to execute arbitrary code on the server, potentially leading to full system compromise and data exfiltration across the entire web application infrastructure.","remediation":"Upgrade to version 26.10.0 or later to remediate this path traversal vulnerability.","detection":"Monitor for unusual file creation patterns in web root directories and check for HTTP requests containing traversal sequences like '../' in the tmpFolderName parameter, particularly from authenticated users with upload privileges.","tags":["web","path-traversal","rce"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:23:25.869Z"}}