CVE-2026-8736
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A security flaw was discovered in Oinone Pamirs up to 7.2.0 in the request.getParameter function of LocalFileClient.java (RestController component). Manipulation of the uniqueFileName argument results in path traversal. The attack may be carried out on the physical device and the exploit is publicly available.
Risk Assessment
An attacker could access files outside the intended directory, potentially reading or overwriting sensitive data. Public exploit availability increases risk.
Recommendation
Restrict access to the RestController component and implement validation of the uniqueFileName argument. Monitor vendor advisories pending a fix.
Other vulnerabilities in Oinone Pamirs
See all- CVE-2026-39054High
Oinone Pamirs version 7.0.0 contains a command injection vulnerability in the CommandHelper.executeCommands method. This method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization.
- CVE-2026-8735Medium
Oinone Pamirs up to 7.2.0 contains a vulnerability in the JsonUtils.parseMap function of PamirsParserConfig.java in the appConfigQuery Interface component. Manipulation leads to deserialization, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond.
Original NVD description (English source)
A security flaw has been discovered in Oinone Pamirs up to 7.2.0. This vulnerability affects the function request.getParameter of the file LocalFileClient.java of the component RestController. Performing a manipulation of the argument uniqueFileName results in path traversal. The attack may be carried out on the physical device. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS