openSIS Classic 9.3 Authenticated Path Traversal in SentMail (CVE-2026-11944)

Vulnerability Overview Vulnerability Name: openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download Vulnerability Type: Path Traversal CVSS Score: 5.3 (Medium) CVE ID: CVE-2026-11944 Discovered By: Daniel Esteban Celis Affected Scope Affected Product: openSIS Classic Affected Version: 9.3 Vulnerability Description: openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the file download process for attachments within the legacy messaging module . An attacker can read arbitrary files, including configuration files, local system files, and sensitive data such as database credentials, by sending a crafted POST request utilizing the parameter. Remediation Current Status: No patch is currently available. Recommended Measures: Wait for an official patch from the vendor or implement temporary mitigations, such as restricting access to the affected module. POC Code Exploitation Steps 1. Login: Log in as a low-privileged user (e.g., student, parent, teacher, or staff member). 2. Send Request: Send a POST request using the POC code above. 3. Adjust Path: Modify the number of segments based on the depth of the deployment path. 4. Expected Result: The server responds with an attachment named containing the content of the target file. Evidence Video Evidence: A video demonstration of the exploit is provided. Static Evidence: Screenshots of the exploit are provided, showing request and response details. Timeline May 5, 2026: Vulnerability discovered June 10, 2026: Contacted vendor June 23, 2026: Vendor responded July 8, 2026: Followed up with vendor July 14, 2026: Public disclosure References GitHub Repository: https://github.com/OS4ED/openSIS-Classic Credits Discoverer: Daniel Celis, Independent Security Researcher --- The above is a summary of key information regarding the path traversal vulnerability in openSIS Classic 9.3.

Goal Reached Thanks to every supporter — we hit 100%!

openSIS Classic 9.3 Authenticated Path Traversal in SentMail (CVE-2026-11944)

More from this source