MEDIUM 5.3 NVD

CVE-2026-115740

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvid

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.

References

https://support.trellix.com/s/article/000015949

Published: 2026-11-05 · Source: NVD · Feed updated: 2026-11-05

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-05 via NVD.

vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.