CVE-2026-116067 Details
Description
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
A path traversal vulnerability has been identified in Paisa versions prior to 0.7.8. The issue resides within the editor and sheet API handlers, specifically in 'GetFile', 'GetSheet', 'DeleteBackups', and 'DeleteSheetBackups'. This vulnerability allows unauthenticated attackers to read files and delete backup files by exploiting '../' sequences in file names. The affected handlers do not properly validate file paths, enabling access to arbitrary files readable by the server process, including sensitive files like SSH keys and dotfiles. Additionally, the vulnerability allows deletion of backup files outside the designated journal or sheets directory.
Users can update to Paisa version 0.7.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ananthakumaran/paisa | [email protected] | ProductVendor |
| https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70 | [email protected] | Source CodeVendor |
| https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31 | [email protected] | Source CodeVendor |
| https://github.com/ananthakumaran/paisa/issues/420 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ananthakumaran Paisa | >= 0, < 0.7.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |