{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-78249 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-78249 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-78249 is a medium-severity path traversal vulnerability in Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model, published on 1 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-78249 and fix it if it is affected.\n\nWhat it is: CVE-2026-78249 is a medium-severity path traversal vulnerability in Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model, published on 1 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-78249 in the wild and no public exploit code.\n\nAffected product: Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-78249/ (Markdown: https://insights.sbomify.com/CVE-2026-78249/index.md)","id":"CVE-2026-78249","markdown":"https://insights.sbomify.com/CVE-2026-78249/index.md","name":"CVE-2026-78249","record":{"aliases":["GHSA-vmmg-gmvf-x548"],"analysis":{"component_type":"iot_embedded","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Multifunction Printer","requires_auth":"high_privilege","summary":"Attackers can exploit a path traversal flaw in the web interface of Fujifilm Apeos printers to access or modify unauthorized files.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"FB","cpe":[],"cvss":{"score":6.8,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed,  specifically in the handling of externally supplied parameters. \n\nIf the device receives a specially crafted, malicious request, it may trigger unintended processing.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Path traversal in Apeos 3060 / 2560 / 1860 Japan model","id":"CVE-2026-78249","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"bytebot-ai bytebot Agent Execution Workflow infinite loop","id":"CVE-2026-78250"},"packages":[],"prev":{"headline":"SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection","id":"CVE-2026-78248"},"products":["Apeos 3060 / 2560 / 1860 Japan model","Apeos 3061 / 2561 / 2061 Japan model","Apeos 3560 / 3060 / 2560 Asia Pacific model","Apeos 3560 / 3060 / 2560 Europe model","Apeos 3561 / 3061 / 2561 Asia Pacific model","Apeos 3561 / 3061 / 2561 Europe model","Apeos 4570 / 3570 Japan model","Apeos 5330 / 4830 Asia Pacific model","Apeos 5330 Japan model","Apeos 5330/4830 Europe model","Apeos 5570 / 4570 Asia Pacific model","Apeos 5570/4570 Europe model","Apeos 6340 Asia Pacific model","Apeos 6340 Japan model","Apeos 7580 / 6580 / 5580 Japan model","Apeos 7580 / 6580 Asia Pacific model","Apeos C2360 / C2060 Japan model","Apeos C3060 / C2560 / C2060 Asia Pacific model","Apeos C3060 / C2560 / C2060 Europe model","Apeos C3061 / C2561 / C2061 Asia Pacific model","Apeos C3061 / C2561 / C2061 Japan model","Apeos C3567 / C3067 / C2567 Asia Pacific model","Apeos C3567 / C3067 / C2567 Japan model","Apeos C4030/C3530 Asia Pacific model","Apeos C4030/C3530 Europe model","Apeos C4030/C3530 Japan model","Apeos C5240 Asia Pacific model","Apeos C5240 Japan model","Apeos C7070 / C6570 / C5570 / C4570 / C3570  / C3070  Europe model","Apeos C7070 / C6570 / C5570 / C4570 / C3570 / C3070 / C2570 Asia Pacific model","Apeos C7070 / C6570 / C5570 / C4570 / C3570 / C3070 / C2570 Japan model","Apeos C7071 / C6571 / C5571 / C4571 / C3571 / C3071 / C2571 Asia Pacific model","Apeos C7071 / C6571 / C5571 / C4571 / C3571 / C3071 / C2571 Japan model","Apeos C8180 / C7580 / C6580 Asia Pacific model","Apeos C8180 / C7580 / C6580 Japan model","ApeosPrint 4560 S / 3960 S / 3360 S Asia Pacific model","ApeosPrint 4560 S / 3960 S / 3360 S Japan model","ApeosPrint 4830 / 4830 JM Japan model","ApeosPrint 5330 Asia Pacific model","ApeosPrint 5330/4830 Europe model","ApeosPrint 6340 Asia Pacific model","ApeosPrint 6340 Japan model","ApeosPrint C3560 S / C3060 S Japan model","ApeosPrint C4030 / C3530 Japan model","ApeosPrint C4030 Asia Pacific model","ApeosPrint C4030/C3530 Europe model","ApeosPrint C5240 Asia Pacific model","ApeosPrint C5240 Japan model","ApeosPrint C5570 / C4570 Japan model","ApeosPrint C5570 Asia Pacific model","ApeosPro C810 / C750 / C650  Europe model","ApeosPro C810 / C750 / C650 Asia Pacific model","ApeosPro C810 / C750 / C650 Japan model","Revoria Press E1136 / E1125 / E1110 /E1100 Europe model","Revoria Press E1136 / E1125/ E1110  / E1100 Asia Pacific model","Revoria Press E1136 / E1125/ E1110  / E1100 Japan model","Revoria Press E1136P/E1125P/E1110P Japan model","Revoria Press EC1100 Asia Pacific model","Revoria Press EC1100 Europe model","Revoria Press EC1100 Japan model","Revoria Press EC2100S / EC2100 Asia Pacific model","Revoria Press EC2100S / EC2100 Europe model","Revoria Press EC2100S / EC2100 Japan model","Revoria Press SC285S / SC285 Asia Pacific model","Revoria Press SC285S / SC285 Europe model","Revoria Press SC285S / SC285 Japan model","RevoriaPress SC180 / SC170  Asia Pacific model","RevoriaPress SC180 / SC170  Europe model","RevoriaPress SC180 / SC170  Japan model"],"published":"2026-10-01","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-01","vendors":["Fujifilm Business Innovation Corp."]},"summary":"Attackers can exploit a path traversal flaw in the web interface of Fujifilm Apeos printers to access or modify unauthorized files.","url":"https://insights.sbomify.com/CVE-2026-78249/"}