CVE-2026-90445Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-90445

Full discourse1 post

CVE@CVEnew45d
Disclosure
CVE-2026-90445 An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within … https://www.cve.org/CVERecord?id=CVE-2026-90445
Post summary
The text announces CVE-2026-90445, describing a path‑traversal flaw when authenticated users upload archives that are extracted without path validation, with no PoC, exploit, patch, or active exploitation details provided.
00000765
58.1K followersView on X

Explore more

Back to dashboard