CVE-2026-61343 Details
Description
LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.
A path traversal vulnerability has been identified in LibreBooking's email template editor. The issue arises because the save action for email templates directly incorporates the submitted template name into the file path without proper validation. This flaw enables a remote attacker with administrator credentials to write arbitrary files outside the designated template directory, potentially leading to code execution. The vulnerability affects LibreBooking versions prior to 5.1.0.
Users can update to LibreBooking version 5.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LibreBooking/librebooking/commit/cb9b7ad9da0243bd105809f6a4a8a6b9147c71ea | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | |
| https://github.com/LibreBooking/librebooking/pull/1456 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | |
| https://github.com/LibreBooking/librebooking/releases/tag/v5.1.0 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | |
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-01.json | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | |
| https://www.cve.org/CVERecord?id=CVE-2026-61343 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |