Path Traversal Vulnerability in Solidtime Time-Tracking Application

CVE-2026-76806

What is CVE-2026-76806?

The Solidtime time-tracking application has a vulnerability that allows attackers to exploit improperly validated input during ZIP imports. Specifically, the TogglDataImporter::importData() method reads project ID values without validation, potentially enabling directory traversal attacks. This could lead to unauthorized directory creation outside of intended directories, impacting system availability and revealing sensitive information about the host's directory structure. Only registered users who can create organizations and utilize the import functionality of the API are affected. The issue has been resolved in version 0.16.0.

References