CVE-2026-93014
7.1 HIGHpublic exploit availablePublished 2026-09-17 · Updated 2026-09-22
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-22
Public exploit & PoC references
All references
- https://gist.github.com/kazisabu/68bd095bc05b2341db318a063e05e644
- https://gitlab.com/francoisjacquet/rosariosis
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/701f9c07330157181362927a40d4f8dcc8094d90
- https://www.vulncheck.com/advisories/rosariosis-before-12.9-path-traversal-in-file-deletion-via-filename-parameter
- https://gist.github.com/kazisabu/68bd095bc05b2341db318a063e05e644
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2017-20284
- MEDIUMCVE-2024-58386PoC
- MEDIUMCVE-2025-1280
- HIGHCVE-2025-1281
- HIGHCVE-2025-14753
- HIGHCVE-2026-100372PoC
- HIGHCVE-2026-100520PoC
- MEDIUMCVE-2026-100533PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.