CVE-2026-57871
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.
Risk Assessment
An attacker could overwrite critical system files, potentially leading to system integrity compromise, arbitrary code execution, or full application takeover.
Recommendation
Immediately update MicroRealEstate to the latest available version that fixes this vulnerability and implement server-side file path validation.
Other vulnerabilities in MicroRealEstate
See all- CVE-2026-57870Medium
A broken object-level access control vulnerability in the Template API of MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
- CVE-2026-57869High
The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.
- CVE-2026-57868High
MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.
- CVE-2026-57867High
A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.
Original NVD description (English source)
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS