/Vulnerability Library

Next4Biz CSM - Arbitrary File Read via DownloadFileHandler

CVE-2026-6377
Early Release

Description

Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.

Severity

High

CVSS Score

8.6

Exploit Probability

2%

Affected Product

csm

Published Date

September 7, 2026

Template Author

1dayexploit

CVE-2026-6377.yaml
8.6Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE ID:
cve-2026-6377
CWE ID:
cwe-22

References

https://1dayexploit.com/blog/cve-2026-6377-next4biz-csm-path-traversal/https://github.com/1dayexploit/advisories/tree/main/advisories/cve-2026-6377-next4biz-csm-path-traversalhttps://nvd.nist.gov/vuln/detail/CVE-2026-6377

Remediation Steps

Update to the vendor-provided fixed release.