CVE-2026-116067 Paisa before 0.7.8 Path Traversal via Editor and Sheet API

High 8.8 Published 25 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116067?

CVE-2026-116067 is a high-severity vulnerability in ananthakumaran paisa, published on 25 Oct 2026.

Official description

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

Weakness: CWE-22

Which versions are affected by CVE-2026-116067?

How do I fix CVE-2026-116067?

No fix has been published for CVE-2026-116067 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116067 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116067 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-c69r-vcvw-qgm3.