Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-63303 Path Traversal in Quick.CMS via Unnormalized URI Path Components https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-63303
Post summary
The post announces a Path Traversal vulnerability (CVE‑2026‑63303) in Quick.CMS involving unnormalized URI path components, providing technical detail but no PoC, exploit, patch, or evidence of active exploitation.