CVE-2026-92970

8.8 HIGHpublic exploit available

Published 2026-09-17 · Updated 2026-09-22

AI risk analysis

Summary: This vulnerability allows authenticated project members to write arbitrary files outside the project repository, potentially leading to code execution.
Exploitability: Exploitation requires authentication and knowledge of traversal sequences, making it moderately difficult.
Blast radius: If exploited, attackers could gain code execution privileges, impacting the entire web server.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to HUBzero CMS 2.2.33 or later.

rcewebauthupload

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.