Is there a public PoC exploit available for CVE-2026-19827?

Yes, a public proof-of-concept exploit is available for CVE-2026-19827. Prioritise patching immediately. EPSS: 0.5%.

AllData CVE-2026-19827

Q: What is the CVSS score of CVE-2026-19827?

CVE-2026-19827 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-58658 MEDIUM

Path Traversal (CWE-22)

2026-08-14 VulDB

GHSA-6gwh-89wg-9gmx

Java Path Traversal Alldata

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable, no authentication per provided vector, read-only file access yields low confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 14, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 14, 2026 - 14:21 vuln.today

CVE Published

Aug 14, 2026 - 13:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project closed the issue report as "not planned" without any further explanation.

AnalysisAI

Path traversal in AllData up to version 0.6.8 enables remote unauthenticated attackers to read arbitrary files from the server filesystem via the logDetailCat endpoint. The executorAddress parameter is passed unsanitized to FileInputStream in JobLogController.java, allowing directory traversal sequences to escape the intended file access boundary. A public exploit has been published on GitHub; no patch exists and the vendor has permanently declined to fix the issue by closing the bug report as 'not planned.'

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal class arising from direct use of user-supplied input in a Java FileInputStream call without sanitization or canonicalization. The affected code resides in /admin/controller/JobLogController.java at the logDetailCat request handler. When the executorAddress argument is manipulated to include traversal sequences such as '../', the FileInputStream reads files outside the intended directory, returning their contents to the caller. The affected product, AllData (CPE: cpe:2.3:a:alldatacenter:alldata:*:*:*:*:*:*:*:*), is a Java-based big data management platform maintained by alldatacenter. All versions through 0.6.8 are confirmed affected per NVD CPE data.

RemediationAI

No vendor-released patch exists - the vendor closed issue #834 as 'not planned' without explanation, leaving all versions through 0.6.8 permanently unpatched. Organizations relying on AllData should evaluate migrating to an actively maintained alternative. As compensating controls: deploy a WAF or reverse proxy rule that blocks requests containing path traversal patterns (e.g., ../, %2e%2e%2f, encoded variants) in the executorAddress parameter targeting the logDetailCat endpoint - note that overly broad rules may affect legitimate requests. Restrict network access to the AllData admin interface to trusted internal networks or VPN only, reducing the attack surface from internet-facing to internal threat actors. If the /admin/ endpoint does not enforce authentication by default, add authentication middleware at the reverse proxy layer. Monitor application and access logs for traversal-pattern anomalies as a detection measure. Advisory reference: https://vuldb.com/vuln/389960.