CVE-2026-62099

Summary

A local file inclusion vulnerability allows unauthenticated attackers to read arbitrary files on the server filesystem, potentially exposing sensitive data like configuration files, database credentials, or application source code.

Exploitability

Exploitation requires sending a crafted request to the vulnerable endpoint with a malicious path traversal payload, but no authentication is needed and the vulnerability affects all versions up to 2.3.3.

Blast radius

If exploited, attackers could access sensitive files including database connection details, application secrets, and potentially gain deeper access to the underlying system through exposed configuration or source code.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Boutique version 2.3.4 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.