CVE-2026-88394

Summary

The WookTeam application is vulnerable to directory traversal in its project task export feature, allowing attackers to read arbitrary files from the server by crafting a malicious JSON payload that escapes the intended storage directory.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the /api/project/task/export endpoint with a crafted JSON payload containing a file path with directory traversal sequences.

Blast radius

An attacker could potentially read sensitive files like configuration files, database credentials, or source code from the server, leading to data exposure and possible further compromise of the application environment.

Detection

Monitor for unusual file access patterns in web server logs, particularly requests to the /api/project/task/export endpoint with file paths containing '../' sequences, and look for access to sensitive files like config.php, database.yml, or .env files in the application root.

Prioritized remediation

Upgrade to WookTeam v1.6.7 or later to address this directory traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.