CVE-2026-32820 Details
Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove directory traversal sequences. An unauthenticated attacker can traverse out of the intended `docs` or `static` directories and render arbitrary `.md` files from the application root or engine root. This is patched in version 26.06.08.
A path traversal vulnerability has been identified in dataCycle-CORE versions prior to 25.07.3. The issue arises in the module responsible for core processing and framework rules, where the documentation and static markdown renderer improperly handle attacker-controlled path segments. These segments are only sanitized using the Rails HTML sanitizer, which fails to remove directory traversal sequences. As a result, an unauthenticated attacker can escape the designated 'docs' or 'static' directories and access arbitrary '.md' files from either the application root or engine root.
Users can upgrade to dataCycle-CORE version 26.06.08 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gc37-6w59-hj36 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datacycle-engine dataCycle-CORE | <= 25.07.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |