CVE-2026-11442

MediumCVSS 6.5

Published: 13/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.25%

66th percentile - higher than 66% of all known CVEs

Summary

A directory traversal vulnerability in Allegra's exportReport method. Allows remote disclosure of sensitive information. Authentication required.

Risk Assessment

An authenticated attacker can read arbitrary files on the server, including configuration data and confidential documents.

Recommendation

Update Allegra to a patched version or apply path validation rules in the exportReport method.

Other vulnerabilities in Allegra

CVE-2026-11443Medium
Allegra contains a Cross-Site Scripting (XSS) vulnerability in the downloadAttachment method, allowing authentication bypass. The issue results from lack of input validation, enabling arbitrary script injection. User interaction is required (visiting a malicious page or opening a file).

Original NVD description (English source)

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the exportReport method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28208.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS