Web-based Vehicle Maintenance Tool Vulnerability in LubeLogger

CVE-2026-62278

What is CVE-2026-62278?

The LubeLogger application, a self-hosted tool for tracking vehicle maintenance and mileage, is vulnerable due to improper handling of uploaded file names before version 1.6.8. Authenticated non-administrative users can exploit this vulnerability to manipulate the file upload process. By influencing the parameters used in file handling, an attacker could potentially move an uploaded file outside the designated storage directories. This could result in unauthorized access to sensitive areas of the server, enabling file placement or overwriting of existing files with the application's permissions. The vulnerability has been addressed in version 1.6.8.

References