{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/paisa--0.7.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:paisa:paisa:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-116067"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Paisa (\u003c 0.7.8)"],"_cs_severities":["high"],"_cs_tags":["web-application","path-traversal"],"_cs_type":"advisory","_cs_vendors":["Paisa"],"content_html":"\u003cp\u003ePaisa versions before 0.7.8 contain a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers. This flaw allows unauthenticated attackers to leverage directory traversal sequences (../) in request parameters to access files or delete backup files residing outside the designated journal or sheets directories.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read arbitrary files accessible to the server process and delete backup files, potentially leading to unauthorized data access and loss of recovery capability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Paisa to version 0.7.8 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing \u0026quot;../\u0026quot; patterns targeting endpoints related to file and backup management.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T12:28:13Z","date_published":"2026-10-25T12:28:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-paisa-path-traversal/","summary":"Paisa versions prior to 0.7.8 contain a path traversal vulnerability in multiple API handlers, allowing unauthenticated attackers to read arbitrary files or delete backups via directory traversal sequences.","title":"Paisa: Path traversal vulnerability (CVE-2026-116067)","url":"https://feed.craftedsignal.io/briefs/2026-10-paisa-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Paisa (\u003c 0.7.8)","version":"https://jsonfeed.org/version/1.1"}