CVE-2026-107092 Details
Description
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
A directory traversal vulnerability has been identified in NexoPOS version 6.2.4, specifically within the 'POST /api/update' endpoint. This vulnerability allows unauthenticated users to traverse the file system and execute arbitrary PHP code by exploiting the application's migration file handling. The endpoint bypasses authentication and directly includes files based on user-supplied input, leading to remote code execution on the server.
Users are advised to upgrade to NexoPOS version 6.3.0 or apply the security-only 6.2.5 release if remaining on the 6.2.x line. After upgrading, it is recommended to run any pending database migrations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://nexopos.com | [email protected] | Broken LinkVendor |
| https://github.com/raivenLockdown/CVE-2026-107092 | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| NexoPOS | <= 6.2.4 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |