PT-2026-23717 · Navtor · Navtor Navbox

Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-2753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Navtor NavBox (affected versions not specified)

Description An Absolute Path Traversal issue exists in Navtor NavBox. The application’s HTTP service does not properly sanitize user-supplied path input. Remote attackers can exploit this by submitting requests containing absolute filesystem paths. Successful exploitation allows retrieval of arbitrary files from the filesystem, limited by the service process privileges. This can expose sensitive configuration files and system information. The vulnerability involves improper handling of user-supplied paths, potentially through a vulnerable parameter or variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2026-2753

Affected Products

Navtor Navbox

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2753 · Security Note
• https://navtor.com/navtor-vendor-statement · Vendor Advisory
• https://cydome.io/vulnerability-advisory-cve-2026-2753-in-navtor-navbox-version-4-12-0-3 · Note
• https://twitter.com/CVEnew/status/2029975493743890913 · Twitter Post