CVE-2026-50186: 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is passed to path.join() beneath private/exports/<userid>/ without containment validation. A crafted value such as ../ can select an arbitrary file readable by the server process, and the file is returned to the attacker. The fileStream close handler then passes the same path to fs.unlink(), deleting the selected file and potentially causing data loss or denial of service. This issue is fixed in version 3.3.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
4gaBoardsto a version that resolves this vulnerability.Fixed in 3.3.8 - Compensating control
Temporarily restrict access to the vulnerable export download endpoint GET /exports/:id/:filename so only trusted users/project managers can reach it until 4gaBoards is upgraded to 3.3.8.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Deployments running versions earlier than 3.3.8 are affected if an authenticated user has the project manager role. The vulnerable export-download endpoint is network-accessible and requires no user interaction.
What access and input are required for exploitation?
An attacker needs authenticated project-manager access and must control the filename portion of a GET request to /exports/:id/:filename. By supplying traversal sequences such as ../, they can target files readable by the server process.
What is the remediation?
Upgrade 4gaBoards to version 3.3.8. The provided data does not identify a separate configuration-based mitigation.
How can I investigate possible exploitation?
Review requests to /exports/:id/:filename for filename values containing traversal sequences, and investigate unexpected file deletions or unavailable server-side files. Successful exploitation both returns the targeted file and passes its path to the file-deletion operation when the stream closes.