CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.
- Published Aug 27, 2026
- CVSS 7.1 high
- 0.8% chance of exploitation in the next 30 days (EPSS)
- A fix is available