Path Traversal Vulnerability in Paisa by Ananthakumaran

CVE-2026-116067

What is CVE-2026-116067?

Paisa versions prior to 0.7.8 exhibit a vulnerability that allows unauthenticated attackers to traverse the file system. This issue affects the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, enabling attackers to craft malicious filenames that, when sent to the editor and delete_backups endpoints, could allow them to read sensitive files and delete backup files located outside the designated directories. Such vulnerabilities pose significant risks to data integrity and confidentiality.

References