CVE-2026-41419 Details

A path traversal vulnerability has been identified in 4ga Boards versions prior to 3.3.5. This vulnerability allows authenticated users with board import privileges to manipulate the server into importing arbitrary host files as board attachments during the BOARDS archive import process. The issue arises because the application fails to properly validate file paths, allowing traversal sequences to escape the intended import directory and access readable files on the host filesystem. Once these files are imported as attachments, they can be downloaded through the application's normal interface, resulting in unauthorized disclosure of local files.

Users are advised to update to 4ga Boards version 3.3.5 or later, where this vulnerability has been fixed.