CVE-2026-116255— PGYER codefever URI Sanitizer doc.php _detail path traversal

Quick assessment

Affected

PGYER codefever

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 PGYER CodeFever 项目（提交哈希至）中发现一处安全漏洞。该漏洞位于组件"URI 清理器”中的文件的函数内。攻击者可通过操纵参数触发路径遍历漏洞。该攻击可远程发起，且相关利用方式已向公众披露，可能被实际利用。由于该产品采用滚动发布模式以提供持续更新，因此无法提供受影响版本或修复版本的具体版本号。该漏洞的修复补丁标识为。建议立即应用该补丁以修复此问题。

CVSS 5.3 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PGYER codefever URI Sanitizer doc.php _detail path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is e4433eee96883a222403854e8ac38b3146774a07. Applying a patch is the recommended action to fix this issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PGYER	codefever	0c35e60f006f9d558cc33a159baf110659351990	`cpe:2.3:a:pgyer:codefever::::::::`

II. Public POCs for CVE-2026-116255

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116255

请登录查看更多情报信息。

Other References for CVE-2026-116255 (7)

https://github.com/PGYER/codefever/ product
https://github.com/PGYER/codefever/pull/226 issue-tracking patch
https://github.com/PGYER/codefever/commit/e4433eee96883a222403854e8ac38b3146774a07 patch
https://gist.github.com/asdfghjkl12345678910111/40ef17031bf9c114fb3888de8793aa25 exploit
https://vuldb.com/cve/CVE-2026-116255 third-party-advisory
https://vuldb.com/vuln/426294/cti signature permissions-required
https://vuldb.com/submit/1009779 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116255

IV. Related Vulnerabilities

Same weakness: CWE-22