CVE-2026-88394
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WookTeam v1.6.6 及更早版本中存在目录遍历漏洞。项目的任务导出接口 在接收带有构造的 JSON 载荷的 参数时，会从服务器下载任意文件。JSON 中的 值直接拼接到 中，未进行任何路径规范化或目录边界检查。因此，攻击者可以通过构造包含 的目录遍历序列突破 目录的限制，最终利用 函数流式传输 Web 服务器进程有权读取的任何文件。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88394
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-88394
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88394
请登录查看更多情报信息。
Other References for CVE-2026-88394 (1)
Same Patch Batch · n/a · 2026-10-05 · 15 CVEs total
| CVE-2026-105307 | 7.3 HIGH | Casdoor API Endpoint authz_filter.go ApiFilter missing authentication |
| CVE-2026-105329 | 6.3 MEDIUM | TallCMS PluginManager ThemeManager.php code injection |
| CVE-2026-105251 | 6.3 MEDIUM | vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds |
| CVE-2026-105248 | 6.3 MEDIUM | vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write |
| CVE-2026-105180 | 6.3 MEDIUM | Jeebase UserService info updateUser dynamically-determined object attributes |
| CVE-2026-105174 | 5.4 MEDIUM | Gerapy Project Management views.py project_create path traversal |
| CVE-2026-105249 | 4.8 MEDIUM | vgmstream TXTP File txtp_process.c make_group_random use after free |
| CVE-2026-105315 | 4.7 MEDIUM | django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injec |
| CVE-2026-105263 | 4.7 MEDIUM | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side requ |
| CVE-2026-105250 | 4.3 MEDIUM | vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero |
| CVE-2026-88391 | Northstar <=9.1.1 H2控制台未授权访问致预认证RCE | |
| CVE-2026-88392 | Unimall v4文件上传目录遍历致任意代码执行 | |
| CVE-2026-37719 | dormakaba evolo Service任意版本.NET组件远程代码执行漏洞 | |
| CVE-2026-88393 | WookTeam v1.6.6前版本导出接口存在RCE漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection -
CVE-2026-105315
django-haystack more_like_this Template Tag elasticsearch_ba -
CVE-2026-105307
Casdoor API Endpoint authz_filter.go ApiFilter missing authe -
CVE-2026-105263
Shaarli Admin Metadata Endpoint MetadataController.php Metad -
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun
V. Comments for CVE-2026-88394
No comments yet