PT-2026-28727 · Elecv2 · Elecv2

Zast.Ai · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-5013

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions elecV2 versions up to 3.8.3

Description A flaw exists in the function path.join within the file /store/:key. Manipulation of the URL argument can lead to path traversal, allowing for remote exploitation. The exploit has been publicly disclosed. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 3.8.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5013

Affected Products

Elecv2

References · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/199 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5013 · Security Note
• https://vuldb.com/submit/779177 · Note
• https://twitter.com/CVEnew/status/2038135162014425455 · Twitter Post
• https://vuldb.com/vuln/353898/cti · Note
• https://vuldb.com/vuln/353898 · Note
• https://github.com/elecV2/elecV2P · Note