CVE-2026-19827CWE-22path-traversal

CVE-2026-19827

Medium · published August 14, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project closed the issue report as "not planned" without any further explanation.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00690 · 52.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-14T18:16Z
References (6)
https://github.com/alldatacenter/alldata/ · [email protected]https://github.com/alldatacenter/alldata/issues/834 · [email protected]https://vuldb.com/cve/CVE-2026-19827 · [email protected]https://vuldb.com/submit/870238 · [email protected]https://vuldb.com/vuln/389960 · [email protected]https://vuldb.com/vuln/389960/cti · [email protected]
EPSS history
Timeline
  • 14 AUG 13:15Z
    alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal
    cvelistv5