CVE-2026-104706

Mitel MiVoice Office 400 view system files path traversal

State: Published
Severity: 8.4 High
Published: Oct 5, 2026
Updated: Oct 5, 2026
Reserved: Oct 2, 2026

Description

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Amber	NCSC.ch

Weaknesses

CWE-31 Path traversal: 'dir\..\..\filename'

Affected Products

Product	Versions
Mitel MiVoice Office 400Mitel	11.0.96.0Affected

References

https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.