PT-2026-23645 · Unknown · Home-Gallery.Org

Onuryildiz1 · Publicado 2026-03-06 · Atualizado 2026-03-11 · CVE-2026-28679

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Home-Gallery.org versions prior to 1.21.0

Description The application does not verify if a requested file for download is within the expected media source directory. This can allow an attacker to download sensitive system files.

Recommendations Update to version 1.21.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-28679

GHSA-XJ65-HCJ5-H6J3

Produtos afetados

Home-Gallery.Org

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28679.json · Exploit
• https://github.com/xemle/home-gallery/security/advisories/GHSA-xj65-hcj5-h6j3 · Aviso do Fabricante
• https://github.com/xemle/home-gallery/releases/tag/v1.21.0 · Nota
• https://t.me/CVEtracker/46548 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2029794534599655583 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28679 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28679 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029975579811008948 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2029859522421117135 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2029977040091251083 · Publicação no Twitter
• https://twitter.com/cracbot/status/2031686839346811082 · Publicação no Twitter