CVE-2026-41544: Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint

Q: What access does an attacker need to exploit this issue?

The attacker must first gain a user account and be able to access the affected QcalAgent functionality remotely.

Q: Which versions should be remediated?

Upgrade QcalAgent to version 1.1.10 or later. The provided information confirms that this version and later include the fix, but does not identify the earliest affected version.

Q: What could exploitation allow?

An authenticated remote attacker could use the path traversal issue to read unexpected files or system data. The reported issue is also described as enabling arbitrary file moves, Docker escape, and host remote code execution.

Published Oct 15, 2026

Updated

A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later

Affected Software

1 affected component

QcalAgent<1.1.10

Event History

Oct 15, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must first gain a user account and be able to access the affected QcalAgent functionality remotely.

Which versions should be remediated?

Upgrade QcalAgent to version 1.1.10 or later. The provided information confirms that this version and later include the fix, but does not identify the earliest affected version.

What could exploitation allow?

An authenticated remote attacker could use the path traversal issue to read unexpected files or system data. The reported issue is also described as enabling arbitrary file moves, Docker escape, and host remote code execution.