CVE-2026-62020

Summary

A remote attacker can include arbitrary local files through a vulnerable parameter in TouchUp versions before 1.4, allowing them to read sensitive files and potentially execute code.

Exploitability

Exploitation requires no authentication and is relatively straightforward with a single vulnerable parameter, though the exact impact depends on which files are accessible to the web server process.

Blast radius

The vulnerability could allow attackers to read configuration files, database credentials, and potentially execute arbitrary code on the affected system, leading to full compromise of the TouchUp application and underlying server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TouchUp version 1.4 or later to remediate this local file inclusion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.