Vulnerability Description
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-90445?
CVE-2026-90445 is a documented vulnerability. An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory...
How severe is CVE-2026-90445?
CVSS scoring is not yet available for CVE-2026-90445. Check NVD for updates.
Is there a patch for CVE-2026-90445?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.