CVE-2026-11442: Allegra exportReport Directory Traversal Information Disclosure Vulnerability
Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is required to exploit this vulnerability.
The specific flaw exists within the exportReport method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28208.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement strict validation and sanitization of the user-supplied path used by exportReport. Reject any path containing traversal sequences (e.g., ../) and ensure file operations are constrained to an allowed/base directory.
Allegra exportReport path_validation = validate and sanitize user-supplied path; reject traversal sequences - Configuration
Reduce the service account's filesystem permissions so it can only read/write the minimum set of directories and files required for operation, limiting the scope of any information disclosure.
Allegra service account file_access_privileges = least privilege - Configuration
If exportReport functionality is not required, disable or remove it to eliminate the vulnerable code path.
Allegra exportReport exportReport_enabled = false (if not required) - Compensating control
Restrict access to the exportReport endpoint to trusted networks or IP ranges using firewall rules, ACLs, or a WAF; limit exposure to only authenticated and authorized users.
- Operational
Monitor and audit access logs for attempts to invoke exportReport or access unexpected files; investigate and respond to any suspicious accesses.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11442?
CVE-2026-11442 has a medium severity rating of 6.5.
How do I fix CVE-2026-11442?
To fix CVE-2026-11442, ensure that you patch your Allegra installation to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-11442?
CVE-2026-11442 is a directory traversal vulnerability that allows sensitive information disclosure.
Who is affected by CVE-2026-11442?
CVE-2026-11442 affects installations of Allegra that have not been patched against this vulnerability.
Is authentication required to exploit CVE-2026-11442?
Yes, authentication is required to exploit CVE-2026-11442.