CVE-2026-93014CWE-22path-traversal

CVE-2026-93014

High · published September 17, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-17T20:18Z
References (5)
https://gist.github.com/kazisabu/68bd095bc05b2341db318a063e05e644 · [email protected]https://gitlab.com/francoisjacquet/rosariosis · [email protected]https://gitlab.com/francoisjacquet/rosariosis/-/commit/701f9c07330157181362927a40d4f8dcc8094d90 · [email protected]https://www.vulncheck.com/advisories/rosariosis-before-12.9-path-traversal-in-file-deletion-via-filename-parameter · [email protected]https://gist.github.com/kazisabu/68bd095bc05b2341db318a063e05e644 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 15:16Z
    RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
    cvelistv5