rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-93468

HGiga OAKlouds contains an arbitrary file read vulnerability caused by relative path traversal. Unauthenticated remote attackers can leverag

Overview

HGiga OAKlouds contains an arbitrary file read vulnerability caused by relative path traversal. Unauthenticated remote attackers can leverage this flaw to access sensitive system files. This poses a significant risk to confidentiality across affected environments.

Description

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.

Impact

The vulnerability directly impacts the confidentiality of the system by allowing unauthorized retrieval of sensitive files without authentication. Integrity and availability remain unaffected by this specific flaw. Organizations utilizing the product are at risk of data exposure if exposed to untrusted networks.

Remediation

Apply the official vendor patch or security update provided by HGiga as soon as possible. Restrict network access to the OAKlouds application interface using a Web Application Firewall (WAF) or strict perimeter controls. Monitor system logs for unusual path traversal patterns or unauthorized file access attempts.

Risk context

Rated as a high severity vulnerability with a CVSS v4 score of 8.7, immediate attention is warranted despite the lack of an available EPSS rating. Internet-facing deployments should be prioritized for mitigation.

Affected products

  • HGiga OAKlouds

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

path-traversal arbitrary-file-read unauthenticated web-application high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis