CVE-2026-76806: Path Traversal
Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\TemporaryDirectory\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projectsusers/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggldataimporter could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Solidtimeto a version that resolves this vulnerability.Fixed in 0.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any registered user who can create an organization can reach the vulnerable import path. Exploitation uses the Toggl data importer through POST /api/v1/organizations/{org}/import with type=toggl_data_importer.
What does an attacker need to provide?
The attacker needs to upload a ZIP import containing a projects.json file with attacker-controlled project ID values. Traversal sequences in those values can influence filesystem paths used during import.
What is the practical impact?
The flaw can create directories at arbitrary writable host paths outside the temporary import sandbox, which may cause a minor availability impact through directory exhaustion. Different import responses can also reveal whether certain suffix-constrained paths derived from projects_users/{id}.json or tasks/{id}.json exist on the host.
What should operators do?
Upgrade Solidtime to version 0.16.0, which fixes the issue. Until then, limiting access to organization creation and the Toggl import endpoint reduces exposure.