THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-40526 (MEDIUM 6.5) — Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_conte

[NVD] CVE-2026-40526 (MEDIUM 6.5) — Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_conte

mednvdPublished 2026-08-27

CVE-2026-40526 CVSS: 6.5 MEDIUM Published: 2026-08-27T17:18:22.833

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted b

Indicators of compromise

CVE-2026-40526cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40526