Personal Management System CVE-2026-40526

Exploitation requires a valid authenticated session (CVSS PR:L confirmed); unauthenticated access to the endpoint is not supported by the available data. The GET /public/get-file/{path} endpoint must be reachable over the network, which is the default deployment posture for this web application - no non-default configuration is required to expose the vulnerable code path. Exploitation does not require directory traversal sequences (../); supplying an absolute path is sufficient, meaning WAF rules that detect only classic traversal patterns may not block this attack variant. Exploitation is bounded by: (1) possession of at least one valid application account; (2) the PHP-FPM worker process's OS-level file permissions determining which files are readable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the threat profile: network-reachable, low-complexity exploitation requiring only a valid user session, with high confidentiality impact and no integrity or availability component. The PR:L requirement is the primary gate - an attacker must first obtain or compromise at least one application account. No EPSS score was supplied and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed widespread exploitation at time of analysis. Despite the moderate immediate threat posture, the attack's simplicity is significant: once a valid credential is in hand, file exfiltration requires only a single crafted HTTP request and no special tooling. For a self-hosted personal productivity application, the stored data (personal finance records, saved passwords, private documents) and application secrets (.env, database credentials, JWT keys) can be high-value targets that enable full secondary compromise. The low prevalence of the product limits aggregate exposure, but any individual deployer faces a meaningful risk given how directly a successful file read can pivot to total application takeover.

An attacker authenticates to the application using a valid low-privilege account and sends a GET request such as GET /public/get-file//var/www/html/.env directly to the application. The PublicFolderAction controller passes the decoded path string to file_get_contents() without validation, returning the .env file contents - including database credentials, JWT signing secrets, and API keys - in the HTTP response. No public exploit code has been identified, but the attack requires no tooling beyond a standard HTTP client and a valid session token.