CVE-2026-8736
Oinone Pamirs RestController LocalFileClient.java request.getParameter path traversal
- State
- Published
- Severity
- 2.4 Low
- Published
- May 17, 2026
- Updated
- May 18, 2026
- Reserved
- May 16, 2026
Description
A security flaw has been discovered in Oinone Pamirs up to 7.2.0. This vulnerability affects the function request.getParameter of the file LocalFileClient.java of the component RestController. Performing a manipulation of the argument uniqueFileName results in path traversal. The attack may be carried out on the physical device. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.4 Low | CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.1 Medium | CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.1 Medium | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
PamirsOinone |
|
References
- VDB-364324 | Oinone Pamirs RestController LocalFileClient.java request.getParameter path traversalvdb-entrytechnical-description
- VDB-364324 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #809889 | Oinone Oinone Oinone <= 7.2.0 File Uploadthird-party-advisory
- https://github.com/SourByte05/SourByte-Lab/issues/14exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.