CVE-2026-63162
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows…
- Risk score
- 63/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to …
- Affected
- See advisory
- Fix
- Upgrade the product to 26.10.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
Last activity 13 Oct 2026. Patch Forecast updates every hour.