{"id":"CVE-2026-88394","published":"2026-10-05T15:17:22.997","lastModified":"2026-10-06T23:16:56.357","description":"WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/WookTeam/fileread.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/fangtang7/CVE/blob/main/WookTeam/fileread.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WookTeam application is vulnerable to directory traversal in its project task export feature, allowing attackers to read arbitrary files from the server by crafting a malicious JSON payload that escapes the intended storage directory.","exploitability":"Exploitation is straightforward with no prerequisites, requiring only access to the /api/project/task/export endpoint with a crafted JSON payload containing a file path with directory traversal sequences.","blast_radius":"An attacker could potentially read sensitive files like configuration files, database credentials, or source code from the server, leading to data exposure and possible further compromise of the application environment.","remediation":"Upgrade to WookTeam v1.6.7 or later to address this directory traversal vulnerability.","detection":"Monitor for unusual file access patterns in web server logs, particularly requests to the /api/project/task/export endpoint with file paths containing '../' sequences, and look for access to sensitive files like config.php, database.yml, or .env files in the application root.","tags":["directory-traversal","web","file-access","api"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:46.870Z"}}