Directory Traversal Information Disclosure Vulnerability in IceWarp

CVE-2026-2493

What is CVE-2026-2493?

The IceWarp collaboration application is susceptible to a directory traversal vulnerability that enables remote attackers to disclose sensitive information from affected installations. The flaw arises in the processing of the 'ticket' parameter at the collaboration endpoint, where inadequate validation of user-supplied paths allows unauthorized access to sensitive files. This vulnerability can be exploited without requiring authentication, potentially allowing attackers to gain access to critical information within the application's context.

References