CVE-2026-11841
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In AppEngine, file access over HTTP is improperly restricted, allowing an unauthenticated attacker to read and write sensitive filesystem areas. A critical directory was exposed, including device parameter files, enabling reading and modification of application settings and customer passwords. Additionally, access to the custom application directory may allow execution of arbitrary Lua code in the AppEngine environment.
Risk Assessment
An attacker can read and modify sensitive settings, including passwords, and potentially execute arbitrary code, leading to full system compromise.
Recommendation
Apply patches that restrict HTTP file access and configure proper authentication rules immediately.
Original NVD description (English source)
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.