Cpe:2.3:a:paisa:paisa:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apaisapaisa/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 12:28:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPaisa: Path traversal vulnerability (CVE-2026-116067)https://feed.craftedsignal.io/briefs/2026-10-paisa-path-traversal/Sun, 25 Oct 2026 12:28:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-paisa-path-traversal/Paisa versions prior to 0.7.8 contain a path traversal vulnerability in multiple API handlers, allowing unauthenticated attackers to read arbitrary files or delete backups via directory traversal sequences.Paisa versions before 0.7.8 contain a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers. This flaw allows unauthenticated attackers to leverage directory traversal sequences (../) in request parameters to access files or delete backup files residing outside the designated journal or sheets directories.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files accessible to the server process and delete backup files, potentially leading to unauthorized data access and loss of recovery capability.

Recommendation

  • Upgrade Paisa to version 0.7.8 or later immediately.
  • Review web server access logs for requests containing "../" patterns targeting endpoints related to file and backup management.
]]>highadvisoryweb-applicationpath-traversal