What is the CVSS score of CVE-2026-36723?

CVE-2026-36723 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of BookCars are affected by CVE-2026-36723?

BookCars v8.3 deployments face a critical security risk: publicly available exploit code enables authenticated users to execute arbitrary system commands and achieve complete server compromise.

How to fix or mitigate CVE-2026-36723?

Within 24 hours: Identify and isolate all BookCars v8.3 instances; restrict network access to the /api/create-user endpoint; review authentication logs for suspicious activity. Within 7 days: Deploy Web Application Firewall rules to block path traversal patterns (../, ..\ and encoded variants) targeting the affected endpoint; conduct forensic analysis of access logs for signs of exploitation. Within 30 days: Monitor vendor security advisories for patches to BookCars v8.3; plan upgrade path if patched version becomes available; assess business continuity implications of migration to alternative solutions if no patch is released.

BookCars CVE-2026-36723

HIGH

Path Traversal (CWE-22)

2026-06-09 mitre

RCE Path Traversal Authentication Bypass N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:23 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).

AnalysisAI

Remote code execution in BookCars v8.3 is achievable by authenticated attackers who abuse a path traversal flaw in the /api/create-user endpoint to rename and relocate files from temporary storage to attacker-chosen filesystem paths. The flaw is tagged as Authentication Bypass, Path Traversal, and RCE, and a public write-up exists in a third-party GitHub repository, though it is not listed in CISA KEV and EPSS is low at 0.17% (38th percentile).

Technical ContextAI

BookCars is an open-source car rental platform with a Node.js backend exposing a REST API. The vulnerable surface is the user-creation handler at /api/create-user, which processes uploaded files (likely user avatars or documents) and performs a server-side rename/move from a temporary upload directory to a permanent storage path. The root cause maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning the destination path is constructed from attacker-controlled input without canonicalization or sandboxing, so '../' sequences escape the intended directory. Because the move operation runs with the application process privileges, the attacker can place arbitrary file content into directories interpreted by the runtime (for example, served static paths or Node module resolution paths), turning a file-rename primitive into code execution.

RemediationAI

No vendor-released patch identified at time of analysis, so operators of BookCars v8.3 should monitor the upstream repository (https://github.com/aelassas/bookcars) for a fixed release and consult the disclosure at https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-17 for technical detail. As compensating controls, restrict network access to /api/create-user behind an authenticated admin reverse proxy or WAF rule that rejects request bodies containing '../', '..\', URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in filename fields - note this can be bypassed by double-encoding so layer with input validation. Run the BookCars Node process as a low-privileged user inside a container with a read-only filesystem except for the dedicated uploads directory, which prevents the rename primitive from clobbering application code at the cost of needing volume mounts for legitimate writes. Disable or gate new user self-registration if the deployment does not require it, since this removes the low-privilege foothold the exploit depends on.