CVE-2026-107092

Summary

NexoPOS v6.2.4 contains a directory traversal vulnerability in the /api/update endpoint, allowing unauthenticated attackers to read arbitrary files on the server by manipulating path components in requests.

Exploitability

Exploitation is trivial for remote attackers due to lack of authentication or input validation on the vulnerable endpoint.

Blast radius

Successful exploitation could lead to full system compromise via exposure of sensitive configuration files, credentials, or source code, enabling further attacks such as lateral movement or data exfiltration.

Detection

Defenders should monitor web server access logs for requests to /api/update containing path traversal sequences (e.g., '../' or encoded variants like '%2e%2e/') in the URI or query parameters.

Prioritized remediation

Upgrade to NexoPOS v6.2.5 or later, which patches the directory traversal vulnerability in the /api/update endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.