CVE-2026-97232 Details

A path traversal vulnerability has been identified in Volotat Anagnorisis versions through 0.4.2. The issue arises in the function 'get_file_content', 'save_file_content', 'move_files', and 'start_streaming' within 'page.html'. This vulnerability allows an authenticated user or an unauthenticated attacker, when combined with a prior authentication flaw, to manipulate files outside the intended media directory. The vulnerability has been publicly disclosed and can be exploited remotely.

To address this vulnerability, it is recommended to implement proper path validation by converting untrusted paths to canonical forms, ensuring they remain within the designated media root, and rejecting absolute paths when only relative ones are acceptable. Additionally, files should be handled with minimal privileges, the application should run as a non-root user, and mutable files should not be processed with 'render_template_string()'.