CVE-2026-78249

MediumCVSS 6.8/10Last modified Oct 1, 2026

Description

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters.

If the device receives a specially crafted, malicious request, it may trigger unintended processing.

Metrics

CVSS 4.0 6.8/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-782504.3A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Wor CVE-2026-782519.3DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload fi CVE-2026-782526.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th CVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application cras CVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to CVE-2026-782558.7The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting CVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782597.3Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78269.1A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 CVE-2026-782609.3Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-782617.1Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.