CVE-2026-116067: Paisa before 0.7.8 Path Traversal via Editor and Sheet API
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and deletebackups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paisato a version that resolves this vulnerability.Fixed in 0.7.8
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Paisa deployments running a version before 0.7.8 are exposed if an attacker can reach the affected editor file or delete_backups endpoints over the network. No authentication or user interaction is required.
What can an attacker access or remove?
An attacker can use ../ sequences in crafted file names to read files that the Paisa server process is permitted to read. They can also delete backup files outside the intended journal or sheets directory.
Which handlers should be reviewed for exposure?
The affected handlers are GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups. The described attack paths specifically use crafted names sent to the editor file and delete_backups endpoints.
How can I determine whether an instance is affected?
An instance is affected if it runs a Paisa version earlier than 0.7.8. Review whether the affected endpoints are network-accessible, particularly to unauthenticated users.