CVE-2026-63162: Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
Which installations should be treated as affected?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or later.
What level of access does an attacker need?
The CVSS vector indicates network reachability, low privileges, and no user interaction are required. An attacker with a low-privileged account can supply a crafted tmpFolderName value.
What is the likely consequence of successful exploitation?
An attacker can write files outside the intended temporary directory, including potentially into the web root. This can lead to remote code execution with high impact to confidentiality, integrity, and availability.