PT-2026-28727 · Elecv2 · Elecv2

Zast.Ai · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-5013

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions elecV2 versions up to 3.8.3

Description A flaw exists in the function path.join within the file /store/:key. Manipulation of the URL argument can lead to path traversal, allowing for remote exploitation. The exploit has been publicly disclosed. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 3.8.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-5013

Produtos afetados

Elecv2

Referências · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/199 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5013 · Nota de Segurança
• https://vuldb.com/submit/779177 · Nota
• https://twitter.com/CVEnew/status/2038135162014425455 · Publicação no Twitter
• https://vuldb.com/vuln/353898/cti · Nota
• https://vuldb.com/vuln/353898 · Nota
• https://github.com/elecV2/elecV2P · Nota