Path Traversal Vulnerability in HUBzero CMS Affects Project File Uploads

CVE-2026-92970

What is CVE-2026-92970?

HUBzero CMS version 2.2.32 is affected by a path traversal vulnerability in its project file upload functionality, allowing authenticated users to exploit this flaw. By providing specially crafted input in the upload parameters, attackers can traverse the directory structure and write files outside the intended project repository. This breach can lead to unauthorized file creation on the server, potentially enabling various security risks including the execution of malicious code under the server's privileges.

References