PT-2026-41011 · Pode · Pode

Tosieeek · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-42598

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Pode versions 2.4.0 through 2.12.x

Description A flaw in the Static Route functionality allows an attacker to request arbitrary files from the local file system by specifying absolute paths in the request, leading to unauthorized information disclosure.

Recommendations Update to version 2.13.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42598

GHSA-7RHP-W8FV-H99Q

Affected Products

Pode

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42598.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-42598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42598 · Security Note
• https://github.com/Badgerati/Pode/issues/1667 · Note
• https://github.com/Badgerati/Pode/security/advisories/GHSA-7rhp-w8fv-h99q · Note