REBUILD CVE-2026-102249

Requires network reachability to a Rebuild instance's web interface and an HTTP request to the /commons/file-editor-save endpoint with a manipulated url or fileKey parameter; per CVSS 4.0 PR:N/UI:N no authentication or user interaction is needed, and no non-default configuration is indicated. Affects Rebuild up to and including 4.4.11. Limiting factors: the endpoint must be exposed/reachable, and the impact is bounded to low-severity read/write of the file-editor resource (VC/VI/VA:L) rather than full system compromise; no fixed version is published and the vendor has not responded, so no official mitigation exists yet.

This is a medium-severity, network-reachable authorization flaw whose real-world priority sits in the low-to-medium band despite the 6.9 CVSS 4.0 score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) plus CWE-862 (missing authorization) confirms an unauthenticated, low-complexity, remotely-triggerable attack against the /commons/file-editor-save endpoint - favorable conditions for an attacker. However, the impact is capped: VC:L/VI:L/VA:L (low confidentiality, integrity, and availability) with no subsequent-system impact (SC/SI/SA:N), so this is not a full-compromise bug. POC/exploit code is publicly available (E:P in the vector, GitHub ASantsSec/CVE issue #26), which raises practical exploitability, but there is NO EPSS score and NO CISA KEV listing in the provided data, so there is no evidence of active, widespread exploitation - this is 'publicly available exploit code exists,' not confirmed in-the-wild use. No SSVC decision data was provided. A key limiting factor: the source is VulDB only, the vendor (getrebuild) was contacted but did not respond, and no fix is referenced, so the root cause and precise impact of manipulating the url/fileKey arguments remain vaguely described ('missing authorization' with unspecified consequence). Overall: real but modest priority - patch/mitigate on a normal cadence rather than emergency.

A remote, unauthenticated attacker sends a crafted request to the /commons/file-editor-save endpoint of an internet-exposed Rebuild instance, manipulating the url or fileKey argument to invoke the file-editor save action without the authorization checks that should gate it. Public exploit code exists (GitHub ASantsSec/CVE issue #26), lowering the bar to weaponization. Because the vector is AV:N/AC:L/PR:N/UI:N, the request requires no credentials, no user interaction, and no special conditions beyond network reachability of the Rebuild web app.