CVE-2026-90925

HighCVSS 7.1/10Last modified Sep 28, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal.

This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2026
Last modified
Sep 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-909268.8Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. CCVE-2026-909276.5filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authentiCVE-2026-909286.5File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle filesCVE-2026-909298.1File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in CVE-2026-90939.8In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML CVE-2026-909306.8File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the taCVE-2026-909315.4LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only theCVE-2026-909327.2LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeControllerCVE-2026-909337.1laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated CVE-2026-909344.3EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticCVE-2026-909354.3Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API cCVE-2026-909364.3Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can