CVE-2026-101082

MediumCVSS 5.3

Published: 28/09/2026(UTC)Updated: 01/10/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

A weakness has been identified in PMWeb 7.x/8.x/2025.x. Unknown processing in downloader.aspx with the FullFileName/FileName argument causes path traversal. The attack may be initiated remotely. The exploit is publicly available. The vendor did not respond.

Risk Assessment

A remote attack can allow access to files outside the intended directory, potentially leading to data disclosure or further compromise.

Recommendation

Immediately restrict access to downloader.aspx, apply vendor patches if available, and monitor logs for exploitation attempts.

Other vulnerabilities in PMWeb

CVE-2026-101083Medium
A vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. An unknown function in the encryptionhelper.dll library leads to information disclosure. The attack may be launched remotely. The vendor did not respond.

Original NVD description (English source)

A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argument FullFileName/FileName causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS