VulnSocial

CVE-2026-86538Patch

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-11); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-11: 1Mentions · 2026-09-17: 1Active Exploitation · 2026-09-17: 1Patch / Workaround · 2026-09-11: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-11: 1Technical Details · 2026-09-17: 109-1109-17
Signal classification2 categories
Patch
150.0%
Active Exploitation
150.0%
Classification over time
DateTotalLabels
2026-09-111
Patch1
2026-09-171
Active Exploitation1
Full discourse2 posts
  • Previdian@PrevidianCyber
    Active Exploitation

    Two new KEVs sighted by Previdian sensors today. • CVE-2026-89013: Dolibarr auth bypass • CVE-2026-86538: knowns path traversal Our honeypots first saw exploitation attempts on Sept 14–15, with a sharp rise today 🚀 Both recently patched. Added to our KEV feed. https://t.co/sbPVYm0VIR

    Post summary

    The text reports two CVEs as actively exploited in the wild, with honeypot detection of exploitation attempts and confirmation of recent patches, classifying the primary focus as active exploitation.

    11022194
    178 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-86538 (CVSS 7.5) Path traversal in knowns <0.30.0 allows unauthenticated attackers to read arbitrary files via /api/templates/preview endpoint. Upgrade immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity https://t.co/SjNlbmRoYG

    Post summary

    The tweet highlights a high‑severity path traversal (CVE‑2026‑86538, CVSS 7.5) affecting knowns <0.30.0, urging users to upgrade immediately; no PoC, exploit, or active exploitation is mentioned.

    0000032
    130 followersView on X

Explore more

Back to dashboard