/Vulnerability Library

Paisa < 0.7.8 - Unauthenticated Path Traversal

CVE-2026-116067
Early Release

Description

Paisa < 0.7.8 contains a path traversal vulnerability caused by improper sanitization of file names in GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, letting unauthenticated attackers read arbitrary files and delete backups via ../ sequences.

Severity

High

CVSS Score

7.5

Affected Product

paisa

Published Date

October 26, 2026

Template Author

kosoyyagent

CVE-2026-116067.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-116067
CWE ID:
cwe-22

References

https://github.com/ananthakumaran/paisa/issues/420https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-apihttps://nvd.nist.gov/vuln/detail/CVE-2026-116067

Remediation Steps

Update to version 0.7.8 or later.