CVE-2026-125385: INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImage
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it. The application permits self-registration, so an attacker may be able to create their own account rather than needing an existing privileged account.
What does an attacker need to send?
The attacker needs to supply path-traversal sequences through the documentName parameter for GetDocument or the imageName parameter for GetImage. The vulnerable code combines these values into file paths without verifying that the resulting path remains within the intended directory.
What data could be exposed?
The issue allows arbitrary file reads using the application's accessible filesystem context. The reported example is appsettings.json, which may contain application configuration or other sensitive information.