Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-09 | 2 | Disclosure2 |
| 2026-07-13 | 1 | Disclosure1 |
CVE-2026-61343 LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administr… https://www.cve.org/CVERecord?id=CVE-2026-61343
Post summary
The post announces a new CVE involving a file path injection flaw in LibreBooking's email template editor, but provides no PoC, exploit tool, active exploitation evidence, or patch details.
Found CVE-2026-61343 an admin RCE on Librebooking recently with GLM and about $5 worth of credits. https://noahmagill.com/blog/cve-2026-61343-librebooking-and-glm/
Post summary
The author reports discovering CVE-2026-61343, an admin RCE in Librebooking, exploited with GLM for roughly $5 worth of credits; the post signals a new vulnerability disclosure rather than active exploitation or mitigation.
🚨*CVE* CVE-2026-61343 LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administr… https://www.cve.org/CVERecord?id=CVE-2026-61343 ----- Traducción: CVE-2026-61343 El … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑61343, a LibreBooking issue where unsanitized template names are used in file paths, enabling administrators to potentially write files outside intended directories.