CVE-2026-93014
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
- Published Sep 17, 2026
- CVSS 7.1 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
- A fix is available