CVE-2026-92970
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.
Risk Assessment
An authenticated project member could write malicious files to arbitrary locations, potentially leading to code execution and full server compromise. A project account is required.
Recommendation
Upgrade HUBzero CMS to a version later than 2.2.32. Restrict write permissions for the web server process and validate uploaded file paths.
Other vulnerabilities in HUBzero CMS
Original NVD description (English source)
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS