CVE-2026-111635: Helical Insight through 7.0.0 Path Traversal via /getExternalResource

Q: Who can exploit this issue?

An attacker must be authenticated as a viewer or another account with equivalent access. The vulnerable endpoint is reachable over the network, and no user interaction is required.

Q: What files can be read?

An attacker can use parent-directory segments in the path parameter to request files outside the solution directory, provided the application process can read them and they have an allowed extension. Examples of allowed extensions include js, json, and html.

Q: Does this only bypass directory restrictions, or does it also bypass resource permissions?

It bypasses per-resource access control in addition to allowing traversal outside the solution directory. A viewer can therefore potentially read eligible files that would not normally be authorized for that account.

Published Oct 16, 2026

Updated

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.

Affected Software

1 affected component

Helical Insight Helical Insight<=7.0.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated as a viewer or another account with equivalent access. The vulnerable endpoint is reachable over the network, and no user interaction is required.

What files can be read?

An attacker can use parent-directory segments in the path parameter to request files outside the solution directory, provided the application process can read them and they have an allowed extension. Examples of allowed extensions include js, json, and html.

Does this only bypass directory restrictions, or does it also bypass resource permissions?

It bypasses per-resource access control in addition to allowing traversal outside the solution directory. A viewer can therefore potentially read eligible files that would not normally be authorized for that account.

CVE-2026-111635: Helical Insight through 7.0.0 Path Traversal via /getExternalResource

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What files can be read?

Does this only bypass directory restrictions, or does it also bypass resource permissions?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What files can be read?

Does this only bypass directory restrictions, or does it also bypass resource permissions?