CVE-2026-62278: LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name could therefore move an uploaded file outside the intended storage directory, enabling unauthorized file placement or overwrite with the privileges of the application process. This issue is fixed in version 1.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LubeLoggerto a version that resolves this vulnerability.Fixed in 1.6.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-administrative user can exploit it. The vulnerable upload path is reachable through HandleTranslationFileUpload.
What does successful exploitation allow?
A crafted upload name can cause an uploaded file to be moved outside the intended web root or data directory. This can enable unauthorized file placement or overwrite with the privileges of the LubeLogger application process.
Which versions are affected and what version fixes it?
Versions prior to 1.6.8 are affected. The issue is fixed in version 1.6.8.