What is the CVSS score of CVE-2026-32820?

CVE-2026-32820 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of dataCycle-CORE are affected by CVE-2026-32820?

Organizations running dataCycle-CORE versions 25.07.3 and earlier face unauthenticated remote data exposure, as attackers can extract sensitive documentation and configuration files without…

How to fix or mitigate CVE-2026-32820?

Within 24 hours, inventory systems running dataCycle-CORE ≤25.07.3 and assess exposure of sensitive documentation, configuration files, and potential credentials. Within 7 days, upgrade all affected systems to dataCycle-CORE 26.06.08. Within 30 days, complete patch deployment verification and document evidence of remediation in vulnerability management systems.

dataCycle-CORE CVE-2026-32820

EUVD-2026-45994 HIGH

Path Traversal (CWE-22)

2026-07-20 GitHub_M

Path Traversal Datacycle Core Datacycle Engine

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with low-complexity traversal (AV:N/AC:L/PR:N/UI:N); read-only .md disclosure gives C:H, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:58 vuln.today

CVE Published

Jul 20, 2026 - 16:09 cve.org

HIGH 7.5

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove directory traversal sequences. An unauthenticated attacker can traverse out of the intended docs or static directories and render arbitrary .md files from the application root or engine root. This is patched in version 26.06.08.

AnalysisAI

Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.

Technical ContextAI

dataCycle is a Rails-based data management system for centrally storing, managing, searching, and distributing data; the affected component is dataCycle-CORE, the engine handling core processing and framework rules. The vulnerable code path is the documentation/static markdown renderer, which builds a filesystem path from user-supplied segments and renders the resulting Markdown file. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the code relies on the Rails HTML sanitizer for input cleansing, but that sanitizer is designed to neutralize HTML/XSS content and does not remove '../' directory-traversal sequences, so it provides no path-confinement guarantee. Because a Rails engine (datacycle-core, per CPE cpe:2.3:a:datacycle-engine:datacycle-core) can be mounted at the host application root, traversal reaches both the application root and the engine root.

RemediationAI

Upgrade dataCycle-CORE to version 26.06.08, which contains the fix (Vendor-released patch: 26.06.08); consult advisory GHSA-gc37-6w59-hj36 at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gc37-6w59-hj36. If immediate upgrade is not possible, restrict or block external access to the documentation and static markdown rendering endpoints (the docs/static routes) at the reverse proxy or WAF, and add a rule rejecting request paths containing traversal sequences such as '../', '..%2f', or encoded variants - noting the trade-off that blocking these routes disables in-app documentation/static content viewing for legitimate users. Because the root cause is that the Rails HTML sanitizer does not confine paths, do not rely on existing sanitization as a control; canonicalizing and validating the resolved path against the intended docs/static base directory is the durable fix delivered by the upgrade.