What is the CVSS score of CVE-2026-1616?

CVE-2026-1616 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Open Security Issue Management are affected by CVE-2026-1616?

A path traversal vulnerability in OSIM versions before 2025.9.0 could allow attackers to access unauthorized files and data through manipulated query parameters.. A patch is available.

How to fix or mitigate CVE-2026-1616?

Within 24 hours: inventory all OSIM instances and confirm versions below 2025.9.0; isolate affected systems from production if critical. Within 7 days: apply vendor patch to all affected OSIM deployments and validate successful deployment. Within 30 days: conduct security audit of affected systems for evidence of exploitation and implement enhanced query parameter validation monitoring.

Open Security Issue Management CVE-2026-1616

HIGH

Path Traversal (CWE-22)

2026-01-29 74b3a70d-cca6-4d34-9789-e83b222ae3be

Nginx Path Traversal Open Security Issue Management

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

Patch released

Mar 10, 2026 - 17:45 nvd

Patch available

CVE Published

Jan 29, 2026 - 14:16 nvd

HIGH 7.5

DescriptionCVE.org

The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.

AnalysisAI

Open Security Issue Management (OSIM) prior to v2025.9.0 contains a path traversal vulnerability in its nginx configuration that improperly concatenates URI and query string parameters, allowing unauthenticated remote attackers to access unauthorized files and directories. The vulnerability affects both OSIM and Nginx deployments using vulnerable configurations, enabling information disclosure through crafted query parameters. A patch is available for affected versions.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects the query component of Open Security Issue Management. The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.