CVE Catalog
CVE-2026-48866
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.50%
40th percentile - higher than 40% of all known CVEs
Summary
A Path Traversal vulnerability in Gravity Forms by Rocketgenius Inc. allows access to files outside the restricted directory. This issue affects versions up to 2.10.0.1 inclusive.
Risk Assessment
An attacker can read or write files outside the application directory, potentially leading to data leakage or further attack escalation.
Recommendation
Update Gravity Forms to a version later than 2.10.0.1 that fixes this vulnerability.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.