Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25575 Path Traversal in NavigaTUM API Allows Unauthenticated File Overwrite https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25575
Post summary
CVE-2026-25575 is a path traversal flaw in NavigaTUM API that permits unauthenticated file overwrite. No evidence of active exploitation, PoC, or patch is provided.
CVE-2026-25575 NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits … https://www.cve.org/CVERecord?id=CVE-2026-25575
Post summary
CVE-2026-25575 reveals a path traversal flaw in NavigaTUM’s propose_edits API that existed prior to commit 86f34c7.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tum | navigatum | - | - | - |