CVE-2026-104806
MediumCVSS 5.5Summary
Path traversal vulnerability in DigitalCanion's management portal, in the Maintenance → System Logs functionality. Allows access to files outside the intended directory, including sensitive system files.
Risk Assessment
An attacker can download confidential files, such as configurations, credentials, or other sensitive data.
Recommendation
Apply the vendor's patch and restrict access to the management portal.
Other vulnerabilities in DigitalCanion
See all- CVE-2026-104809High
A vulnerability was discovered in DigitalCanion's product where a privileged process loads an attacker-controlled .so file with a predictable module name without verifying its origin or integrity. The malicious module is then executed with the privileges of that process.
- CVE-2026-104805High
A vulnerability in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files during restoration. The mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive.
- CVE-2026-104706High
A path traversal vulnerability was discovered in DigitalCanion's product that allows viewing or downloading sensitive system files over the portal https://<ip>:8443 via the Administration -> View Logs menu.
Original NVD description (English source)
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure. By exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS