CVE-2026-88394

HighCVSS 7.5

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.

Risk Assessment

The risk includes the possibility of remote reading of arbitrary files from the server, including configuration files, keys, or user data, which could lead to sensitive information leakage.

Recommendation

It is recommended to immediately upgrade WookTeam to the latest version and implement path validation and normalization. Also restrict access to the export endpoint.

Other vulnerabilities in WookTeam

CVE-2026-88393Critical
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS