PT-2026-39853 · Unknown · Jotty·Page

Qiaonpc · CVE-2026-42564 · Published 2026-05-11 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions jotty·page versions prior to 1.22.0

Description An unauthenticated path traversal issue exists in the '/api/app-icons/[filename]' endpoint. The filename route parameter is joined into a filesystem path without proper traversal or boundary validation, which allows an attacker to read files located outside the 'data/uploads/app-icons/' directory. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update to version 1.22.0.

Exploit

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2026-42564

GHSA-7843-GWQ8-G96F

Affected Products

Jotty·Page

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42564.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-42564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42564 · Security Note
• https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f · Note
• https://twitter.com/VulmonFeeds/status/2054030824886939833 · Twitter Post
• https://t.me/CVEtracker/53403 · Telegram Post