CVE-2026-40526
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Volmarg Personal Management System has a path traversal vulnerability allowing authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling access to sensitive files accessible to the PHP-FPM worker.
Risk Assessment
An attacker can read sensitive system files, such as configurations, passwords, or user data, leading to confidentiality breach.
Recommendation
Apply a patch that canonicalizes paths and restricts access to a permitted base directory, and limit endpoint access to trusted users.
Other vulnerabilities in Volmarg Personal Management System
See all- CVE-2026-73328High
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
- CVE-2026-118755High
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Original NVD description (English source)
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS