EUVD-2026-22956
GHSA-q6x9-g748-283m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
These vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system.
AnalysisAI
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path
More in Cisco Unity Connection
View allRemote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send a
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote att
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary dat
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today