Path Traversal Vulnerability in Volmarg Personal Management System

CVE-2026-40526

What is CVE-2026-40526?

The Volmarg Personal Management System is susceptible to a path traversal vulnerability that can be exploited by authenticated attackers. By supplying absolute filesystem paths in requests to the GET /public/get-file/{path} endpoint, attackers can access arbitrary files. This vulnerability arises because the path parameter is directly used in the file_get_contents() function without proper verification against an authorized base directory. As a result, sensitive files that are accessible to the PHP-FPM worker process can be retrieved without the need for directory traversal techniques.

References