CVE-2026-111635 Details
Description
Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.
A path traversal vulnerability has been identified in Helical Insight versions through 7.0.0. This vulnerability allows authenticated users with the viewer role to read files outside the designated solution directory. The issue arises in the getExternalResource endpoint, where the path parameter is processed without proper validation, enabling the exploitation of parent-directory traversal sequences. Attackers can access any readable file with a permitted extension, such as JavaScript, JSON, or HTML, thereby circumventing access controls that are typically enforced on a per-resource basis.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli | CISA-ADP | BundleExploitTechnical Analysis |
| https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/efw/controller/EFWController.java#L547-L557 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-path-traversal-via-getexternalresource | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Helical Insight | <= 7.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |