CVE-2026-108158 Details

A path traversal vulnerability has been identified in plugNmeet Server versions through 2.5.2. This vulnerability exists in the whiteboard conversion endpoint, where any meeting participant can read server files by sending crafted filePath values. The issue arises because the server does not properly validate the file paths before processing them. Attackers can exploit this by including '../' sequences to traverse directories, access files outside the intended directory, and have them converted into images. These images can then be downloaded without authentication.

The vulnerability can be fixed by implementing proper validation of the file paths in the whiteboard conversion endpoint. This includes checking that the paths do not escape the intended directory and enforcing whiteboard privileges to prevent unauthorized access.