CVE-2026-105947

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal.

This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Innotim Software, Telecommunications, and Consulting Co. Ltd.	Logsign SIEM	>= 6.4.120, < 6.4.122

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1397

Timeline

Published: Oct 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059487.7In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login CVE-2026-1059498.8Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint CVE-2026-105957.5A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/rout CVE-2026-1059503.5A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribut CVE-2026-1059576.3A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /op CVE-2026-1059587.5A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without CVE-2026-1059597.5A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc CVE-2026-1059605.5PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued reco CVE-2026-1059635.1Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauth CVE-2026-1059646.5The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow a CVE-2026-1059675.8The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-sid CVE-2026-1059695.3The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing u