CVE-2026-5013 Details

A path traversal vulnerability has been identified in elecV2 elecV2P versions through 3.8.3. The issue arises in the /store/:key endpoint, where the URL parameter is passed directly to the path.join function without proper sanitization. This vulnerability allows for the manipulation of the file path to escape the intended directory and access arbitrary files on the server. The vulnerability can be exploited remotely, without authentication, and has been publicly disclosed along with a proof-of-concept exploit that demonstrates its impact by reading the /etc/passwd file.