CVE-2026-41530

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name, then the archived files may be extracted to an unexpected folder.

Metrics

CVSS 4.0 4.6/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-415396.1A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can thenCVE-2026-41547.8GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary CVE-2026-415415.3An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accountCVE-2026-415448.7A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vCVE-2026-415458.6A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can tCVE-2026-41557.5ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remoCVE-2026-415519.1A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user iCVE-2026-415527.5PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unautheCVE-2026-4155310.0PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitCVE-2026-415547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. CVE-2026-415559.3Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.CVE-2026-415566.5Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.