CVE-2026-79653CWE-22CWE-73path-traversal

CVE-2026-79653

published August 27, 2026

CVSS
6.0
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal.

The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00474 · 40.0th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-08-27T21:20Z
References (5)
https://github.com/eclipse-sw360/sw360/pull/4516 · [email protected]https://github.com/eclipse-sw360/sw360/pull/4517 · [email protected]https://github.com/eclipse-sw360/sw360/pull/4518 · [email protected]https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/765 · [email protected]https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/765 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 13:25Z
    In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key…
    cvelistv5