CVE-2026-56860

MediumCVSS 5.9/10Last modified Sep 3, 2026

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-568627.5Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not CVE-2026-568647.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor CVE-2026-568658.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an CVE-2026-568667.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without fra CVE-2026-56878.8A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStati CVE-2026-568768.1extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a CVE-2026-568776.3The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter a CVE-2026-568796.7In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of p CVE-2026-56887.3A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bi CVE-2026-568818.4In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of CVE-2026-568828.8In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution wit CVE-2026-568886.2In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation