Paisa CVE-2026-116067

Exploitation requires only that a Paisa instance before v0.7.8 be reachable over the network: the GetFile/GetSheet (editor file) and DeleteBackups/DeleteSheetBackups (delete_backups) endpoints accept an attacker-controlled file name and, pre-fix, pass it directly into filepath.Join/filepath.Glob without confinement, so '../' sequences escape the journal or sheets directory. Per the CVSS vector there is no authentication (PR:N), no user interaction (UI:N) and no non-default configuration required - any default deployment is affected. The principal limiting factor is exposure: Paisa is designed as a locally run, single-user self-hosted finance tool, so realistic risk depends on the instance being bound to an interface reachable by untrusted clients rather than localhost. Read impact is bounded to files readable by the server process account; the destructive action is limited to deletion of backup (.backup.*) files.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable flaw: network-accessible, low attack complexity, no authentication (PR:N) and no user interaction, yielding high confidentiality impact (VC:H) from arbitrary file reads plus low integrity impact (VI:L) from backup deletion. The vuln.today decision label is 'this_week' rather than act_now/emergency, and the input provides no EPSS score and no KEV listing, so there is no evidence of active exploitation or mass-scanning pressure at this time. The dominant mitigating signal is deployment footprint, not technical difficulty: Paisa is a self-hosted personal-finance (double-entry accounting) application typically run locally by a single user, so the unauthenticated network exploitability only translates into real risk where an instance has been deliberately exposed to an untrusted network. Net assessment: technically a genuine high-severity unauthenticated path traversal confirmed by the vendor patch, but its practical priority is bounded by low real-world prevalence and the absence of KEV/EPSS corroboration - treat it as a prompt patch for exposed instances rather than a widespread emergency.

An attacker who can reach a network-exposed Paisa instance sends a crafted file name containing '../' sequences to the editor 'GetFile'/'GetSheet' endpoints to read any server-readable file outside the journal or sheets directory, and to the 'delete_backups' endpoints to remove backup files outside those directories. No authentication or user interaction is required per the CVSS vector. No confirmed working public exploit code is listed in the input, though a VulnCheck advisory, a GitHub issue (#420) and the fixing commit are published.