Path Traversal Vulnerability in 4gaBoards Project Management System

CVE-2026-50186

What is CVE-2026-50186?

The 4gaBoards system for realtime project management suffers from a path traversal vulnerability that allows authenticated project managers to exploit the filename parameter in the GET /exports/:id/:filename endpoint. Without proper validation, an attacker can manipulate this parameter to access arbitrary files on the server, potentially leading to unauthorized file retrieval and subsequent data deletion, resulting in data loss or service interruptions. This critical issue has been addressed in version 3.3.8.

References