CVE-2026-11944: openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download

Published Jul 14, 2026

Updated

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

Affected Software

5 affected components

openSIS openSIS Classic=9.3

All of the following

OS4ED openSIS=9.3

Any of the following

Apple macOS

Linux Linux kernel

Microsoft Windows

Event History

Jul 14, 2026

CVE Published

via MITRE·03:23 PM

Data Sourced

via MITRE·03:23 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-11944?

CVE-2026-11944 has a medium severity rating of 5.3 according to the CVSS.

How do I fix CVE-2026-11944?

To fix CVE-2026-11944, update to the latest version of openSIS Classic that resolves the path traversal vulnerability.

What does CVE-2026-11944 affect?

CVE-2026-11944 affects openSIS Classic 9.3, specifically its sent-mail attachment download functionality.

What kind of vulnerability is CVE-2026-11944?

CVE-2026-11944 is an authenticated path traversal vulnerability that allows attackers to read arbitrary files on the server.

Who is at risk from CVE-2026-11944?

Authenticated users of openSIS Classic 9.3 are at risk from CVE-2026-11944, as they can exploit the vulnerability to gain unauthorized access to files.