CVE-2026-19054: Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal
A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument filePath results in path traversal. The attack is only possible with local access. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19054?
The severity of CVE-2026-19054 is classified as medium with a score of 5.3.
How do I fix CVE-2026-19054?
To fix CVE-2026-19054, ensure the Lspace-io lspace-server is updated to a version later than 79f02fe5aa8970b210a6a05cf097155f8d9ffd71.
What type of vulnerability is CVE-2026-19054?
CVE-2026-19054 is a path traversal vulnerability affecting the Repositories File API in Lspace-io lspace-server.
What components are impacted by CVE-2026-19054?
CVE-2026-19054 impacts the functions fileExists, readFile, writeFile, and deleteFile in src/core/repository.ts of the Repositories File API.
What is the publication date of CVE-2026-19054?
CVE-2026-19054 was published on August 6, 2026.