CVE-2026-92970: HUBzero CMS through 2.2.32 Path Traversal via File Upload
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HUBzero CMSto a version that resolves this vulnerability.Fixed in 2.2.32Patch Path Traversal via File Upload
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated member of a project. The issue is exposed through project file upload handlers.
What level of access does exploitation require?
The attacker needs low privileges: authenticated project-member access. No user interaction is required, and the attack can be performed remotely over the network.
What is the practical impact of a successful exploit?
An attacker can use traversal sequences in upload parameters to write files outside the project repository to paths they choose, with the privileges of the web server. This may enable code execution and can affect confidentiality, integrity, and availability.
Which versions are affected?
HUBzero CMS through version 2.2.32 is affected.