CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.8. Its EPSS score suggests a 31.4% probability of exploitation in the next 30 days.
CVE
CVE-2026-5027
Severity
HIGH
CVSS
8.8
EPSS
31.41%
Original NVD Description
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').