CVE-2026-70383CWE-22path-traversal

CVE-2026-70383

published August 20, 2026

CVSS

8.4

EPSS

Percentile

8.2

In the wild

Unconfirmed

What it is

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.

This issue affects DigiDoc4: from 4.0.0 before 4.11.0.

The record

Technical detail

CVSS: 8.4 · NONE
CVSS v4.0: 8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00190 · 8.2th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-08-20T18:17Z

References (3)

https://github.com/open-eid/DigiDoc4-Client · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 https://github.com/open-eid/DigiDoc4-Client/pull/1402 · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 https://github.com/open-eid/libdigidocpp/pull/736 · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

EPSS history

Timeline

20 AUG 14:04Z
Arbitrary file overwrite vulnerability in DigiDoc4 client
cvelistv5