PT-2026-41521 · Unknown · Oinone Pamirs

Sourbyte · Published 2026-05-17 · Updated 2026-05-17 · CVE-2026-8736

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oinone Pamirs versions prior to 7.2.0

Description A path traversal flaw exists in the RestController component within the LocalFileClient.java file. The issue occurs in the request.getParameter() function when the uniqueFileName argument is manipulated, allowing an attacker with physical access to the device to perform path traversal.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the uniqueFileName argument within the request.getParameter() function of the RestController component.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-8736

Affected Products

Oinone Pamirs

References · 8

• 🔥 https://github.com/SourByte05/SourByte-Lab/issues/14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8736 · Security Note
• https://twitter.com/VulmonFeeds/status/2055918175783370898 · Twitter Post
• https://t.me/CVEtracker/54033 · Telegram Post
• https://vuldb.com/vuln/364324/cti · Note
• https://vuldb.com/vuln/364324 · Note
• https://t.me/cveNotify/163765 · Telegram Post
• https://vuldb.com/submit/809889 · Note