LOWVulnerability
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
Properties
- last_source
- NVD
- cve_id
- CVE-2026-77139
- signal_observed_at
- 2026-09-29T00:56:27+00:00
- retrieved_at
- 2026-09-29T00:56:27+00:00
- published_at
- 2026-08-25T09:17:34.647
- last_modified
- 2026-09-28T23:10:00.143
Related Entities (3)
HAS_WEAKNESS (2)
→[Weakness]External Control of File Name or Path
→[Weakness]Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph