CVE-2026-8326
Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE
- State
- Published
- Severity
- 10.0 Critical
- Published
- May 29, 2026
- Updated
- May 29, 2026
- Reserved
- May 11, 2026
Description
Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection. Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker.
This issue affects SparkView: before build 1127.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | NCSC.ch |
Weaknesses
- CWE-23 Relative path traversal
Affected Products
| Product | Versions |
|---|---|
SparkViewRemote Spark (https://www.remotespark.com/) |
|
References
- https://www.remotespark.com/view/new.htmlrelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.