CVE-2026-116067

HighPublished

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

Published: Oct 25, 2026
Updated: Oct 25, 2026
Assigning CNA: VulnCheck

Primary CVSS

8.8/ 10High

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Summary

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Paisa < 0.7.8 - Unauthenticated Path TraversalTemplate
http/cves/2026/CVE-2026-116067.yaml
Nuclei Templates
DetectionEvidence observed: Oct 26, 2026Revision: ecfecad2dec6Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.