CVE-2026-93014: RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RosarioSISto a version that resolves this vulnerability.Fixed in 12.9 - Configuration
Ensure RosarioSIS validates the 'filename' request parameter in the Users and Students modules to prevent parent-directory sequences from escaping upload directories and unlinking allow-listed files.
RosarioSIS Users and Students modules filename request parameter validation = properly validate filename (prevent parent-directory/path traversal)
Event History
Frequently Asked Questions
Which deployments are affected?
RosarioSIS versions before 12.9 are affected when the vulnerable file-deletion functionality in the Users or Students modules is accessible.
What does an attacker need to exploit this issue?
An attacker needs an authenticated RosarioSIS account with low privileges. No user interaction is required, and the attack can be performed remotely by supplying parent-directory sequences in the filename parameter.
What can an attacker delete?
The issue permits deletion of allow-listed files outside the intended upload directories, including CSS, XML, JSON resources, and other users' documents elsewhere in the installation.