CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.

An attacker could exploit the vulnerability to read or manipulate files outside the permitted directory, potentially leading to data disclosure or unauthorized operations.

Upgrade NexoPOS to a patched version. Implement path validation in the api/update endpoint to prevent traversal.