VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026

CVE-2026-49488

CVE-2026-49488

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.

This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.

Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Affected products

2
  • Apache/Openmeetings2 versions
    cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*range: >=5.0.0,<9.1.0
    • (no CPE)range: from 5.0.0 before 9.1.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.