Paisa: Path traversal vulnerability (CVE-2026-116067)
Paisa versions prior to 0.7.8 contain a path traversal vulnerability in multiple API handlers, allowing unauthenticated attackers to read arbitrary files or delete backups via directory traversal sequences.
CVE search metadata
CVE search record: CVE-2026-116067. Severity: high. CVSS: 8.2. KEV: no. Product: Paisa (< 0.7.8). Brief: Paisa: Path traversal vulnerability (CVE-2026-116067). Brief link: https://feed.craftedsignal.io/briefs/2026-10-paisa-path-traversal/
Triage facts
Revision 1- Applicability
- Paisa (< 0.7.8)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 12:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Paisa versions before 0.7.8 contain a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers. This flaw allows unauthenticated attackers to leverage directory traversal sequences (../) in request parameters to access files or delete backup files residing outside the designated journal or sheets directories.
Impact
Successful exploitation allows unauthenticated attackers to read arbitrary files accessible to the server process and delete backup files, potentially leading to unauthorized data access and loss of recovery capability.
Recommendation
- Upgrade Paisa to version 0.7.8 or later immediately.
- Review web server access logs for requests containing "../" patterns targeting endpoints related to file and backup management.
Immediate actions
Upgrade Paisa to version 0.7.8 or later
Threat Hunt
Identify HTTP requests containing directory traversal sequences directed at file or backup management endpoints
Data: Web server access logs or WAF logs
Mitigations
Apply patch 0.7.8
CVE-2026-116067