CVE-2026-19532— Path Traversal in HAVELSAN's Liman MYS
Quick assessment
Affected
HAVELSAN Inc. Liman MYS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HAVELSAN Inc. Liman MYS 中存在限制路径名到受限目录的“路径遍历”漏洞，攻击者可以利用该漏洞进行路径遍历。 此漏洞影响 Liman MYS 以下版本：从 2.3.2 到 2.3.4-1124（不含 2.3.4-1124）。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HAVELSAN Inc. | Liman MYS | 2.3.2< 2.3.4-1124 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19532
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in HAVELSAN's Liman MYS
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal.
This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HAVELSAN Inc. | Liman MYS | 2.3.2 ~ 2.3.4-1124 | - |
|
II. Public POCs for CVE-2026-19532
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19532
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19532 (1)
-
🔗 T.C. Siber Güvenlik Başkanlığı - Güvenlik Bildirimleri Detay government-resource
Same Patch Batch · HAVELSAN Inc. · 2026-09-24 · 3 CVEs total
| CVE-2026-77703 | 5.9 MEDIUM | SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine |
| CVE-2026-77707 | 5.9 MEDIUM | TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render En |
IV. Related Vulnerabilities
Same product: Liman MYS
-
CVE-2026-18650
Missing Authorization Leading to Root Code Execution in HAVE -
CVE-2026-17070
Vault Credential Confusion via Authorization Bypass in HAVEL -
CVE-2026-13696
LDAP Injection in HAVELSAN's Liman MYS -
CVE-2026-11348
Authentication Bypass in HAVELSAN's Open Source Project Lima -
CVE-2026-11340
Authorization Bypass in HAVELSAN's Open Source Project Liman
Same vendor: HAVELSAN Inc.
-
CVE-2026-80298
SQL Injection in HAVELSAN's Sef - AI Chatbot Platform -
CVE-2026-80443
Insecure TLS Certificate Validation in API Tool Runner in HA -
CVE-2026-80337
Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef -
CVE-2026-80464
API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform -
CVE-2026-77707
TLS Certificate Validation Disabled for Keycloak Connections
Same weakness: CWE-22
-
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path tra -
CVE-2026-105125
LaraDashboard before 1.4.8 Path Traversal via /api/translati -
CVE-2026-104983
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_ -
CVE-2026-104982
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf -
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauth
V. Comments for CVE-2026-19532
No comments yet