CVE-2025-11466
MediumCVSS 4.9Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A Directory Traversal Information Disclosure vulnerability in the DatabaseBackupBL class of Allegra allows remote attackers to disclose sensitive information on affected installations. The flaw results from the lack of proper validation of a user-supplied path prior to using it in file operations. Authentication is required, and an attacker can leverage this to disclose information in the context of the service account.
Risk Assessment
An authenticated attacker can read sensitive files from the system, potentially leading to disclosure of sensitive data. The risk affects organizations using Allegra.
Recommendation
Apply available updates from the Allegra vendor. Until deployed, restrict access to the backup functionality to trusted users.
Other vulnerabilities in Allegra
See all- CVE-2026-11443Medium
Allegra contains a Cross-Site Scripting (XSS) vulnerability in the downloadAttachment method, allowing authentication bypass. The issue results from lack of input validation, enabling arbitrary script injection. User interaction is required (visiting a malicious page or opening a file).
- CVE-2026-11442Medium
A directory traversal vulnerability in Allegra's exportReport method. Allows remote disclosure of sensitive information. Authentication required.
Original NVD description (English source)
Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the DatabaseBackupBL class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-27136.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS