MEDIUM 6.0 NVD
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authe
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
References
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-08-25 via NVD.
vulnfeed aggregates 12116 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.