CVE-2026-2493

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability.

The specific flaw exists within handling of the ticket parameter provided to the collaboration endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-25440.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-249305.5UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249315.5Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect servCVE-2026-249325.9The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection usCVE-2026-249335.9The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificateCVE-2026-249343.7The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the devCVE-2026-249355.6A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access tCVE-2026-249369.8When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CVE-2026-249377.2Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. ThiCVE-2026-249385.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allowCVE-2026-249394.3Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured AccesCVE-2026-24944.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up CVE-2026-249404.3Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control