PT-2026-56903 · Librebooking · Librebooking

Noah Magill · Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-61343

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-61343

Affected Products

Librebooking

References · 6

• https://github.com/LibreBooking/librebooking/commit/cb9b7ad9da0243bd105809f6a4a8a6b9147c71ea · Patch
• https://github.com/LibreBooking/librebooking/pull/1456 · Patch
• https://cve.org/CVERecord?id=CVE-2026-61343 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-61343 · Security Note
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-01.json · Note
• https://github.com/LibreBooking/librebooking/releases/tag/v5.1.0 · Note