PT-2026-5369 · Unknown · Polarlearn

Jvr2022 · Publicado 2026-01-29 · Atualizado 2026-01-30 · CVE-2026-25126

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-15

Description PolarLearn is a free and open-source learning program. The POST /api/v1/forum/vote API route trusts the direction value within the JSON body without runtime validation. TypeScript types are not enforced during runtime, allowing an attacker to send arbitrary strings, such as "x", as the direction parameter. The VoteServer component interprets any value other than "up" or null as a downvote, persisting the invalid value in votes data. This can be used to bypass intended business logic.

Recommendations Update to version 0-PRERELEASE-15 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-25126

GHSA-GHPX-5W2P-P3QP

Produtos afetados

Polarlearn

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25126.json · Exploit
• https://github.com/polarnl/PolarLearn/commit/e6227d94d0e53e854f6a46480db8cd1051184d41 · Correção
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-ghpx-5w2p-p3qp · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2017000646256247039 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2017060251665617230 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25126 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25126 · Nota de Segurança
• https://t.me/CVEtracker/43260 · Publicação no Telegram