CVE-2026-111635

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.

An authenticated attacker can read files outside the solution directory, leading to a breach of data confidentiality. The organization may face legal consequences and loss of trust.

Update Helical Insight to a version newer than 7.0.0 if available, or fix the path traversal vulnerability in /getExternalResource. Restrict access to this endpoint and validate path parameters.