PT-2026-39853 · Unknown · Jotty·Page

Qiaonpc · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-42564

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions jotty·page versions prior to 1.22.0

Description An unauthenticated path traversal issue exists in the '/api/app-icons/[filename]' endpoint. The filename route parameter is joined into a filesystem path without proper traversal or boundary validation, which allows an attacker to read files located outside the 'data/uploads/app-icons/' directory. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update to version 1.22.0.

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2026-42564

Affected Products

Jotty·Page

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42564 · Security Note
• https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f · Note
• https://twitter.com/VulmonFeeds/status/2054030824886939833 · Twitter Post
• https://t.me/CVEtracker/53403 · Telegram Post