PT-2026-36677 · Kerwincui · Fastbee

Xcxr · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7676

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions kerwincui FastBee versions prior to 1.2.2

Description A path traversal issue exists in the Tool Download Endpoint. Remote attackers can manipulate the fileName argument within the download() function of the ToolController class to access files outside the intended directory.

Recommendations As a temporary workaround, restrict access to the download() function in the ToolController class to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7676

Affected Products

Fastbee

References · 8

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7676 · Security Note
• https://twitter.com/VulmonFeeds/status/2050819782946001286 · Twitter Post
• https://vuldb.com/submit/800723 · Note
• https://vuldb.com/vuln/360829 · Note
• https://t.me/cveNotify/161906 · Telegram Post
• https://vuldb.com/vuln/360829/cti · Note
• https://t.me/CVEtracker/52554 · Telegram Post