CVE-2026-40526: Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to filegetcontents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Volmarg Personal Management System and able to send requests to the GET /public/get-file/{path} endpoint. No user interaction is required.
What files could be exposed?
The endpoint can read arbitrary files specified with absolute filesystem paths, provided those files are readable by the PHP-FPM worker process. The disclosed impact is confidentiality loss; integrity and availability impacts are not indicated.
Does exploitation require directory traversal sequences?
No. The issue can be exploited by supplying an absolute filesystem path, because the route parameter is passed directly to file_get_contents() without being restricted to an allowed base directory.