High severity8.8NVD Advisory· Published Jun 9, 2026· Updated Jun 10, 2026

CVE-2026-36723

Description

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bookcars/bookcarsllm-fuzzy
Range: =8.3

Patches

Vulnerability mechanics

References

github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-17nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000