Which versions of Personal Management System are affected by CVE-2026-40526?

Volmarg Personal Management System is vulnerable to a data exposure flaw (CVE-2026-40526) that allows any authenticated user to read sensitive files from affected servers, including application…. A patch is available.

How to fix or mitigate CVE-2026-40526?

Within 24 hours, identify all instances of Volmarg Personal Management System in production and review access logs for suspicious activity on the file retrieval endpoint. Within 7 days, apply the available vendor patch to all affected deployments, prioritizing instances handling sensitive personal or financial data. Within 30 days, conduct a security review to identify any previously accessed files, rotate any exposed credentials, and consider network-level access controls as a temporary measure if patching is delayed.

Personal Management System CVE-2026-40526

Q: What is the CVSS score of CVE-2026-40526?

CVE-2026-40526 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-67124 HIGH

Path Traversal (CWE-22)

2026-08-27 VulnCheck

GHSA-g95v-m725-f6xc

Path Traversal Personal Management System

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint requires low-privilege authentication; only confidentiality is impacted as arbitrary file read confers no write or denial-of-service capability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 27, 2026 - 18:01 vuln.today

Analysis Generated

Aug 27, 2026 - 18:01 vuln.today

CVE Published

Aug 27, 2026 - 13:12 cve.org

HIGH 7.1

DescriptionCVE.org

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.

AnalysisAI

Path traversal in Volmarg Personal Management System exposes arbitrary server-side files to any authenticated user through the GET /public/get-file/{path} endpoint. The Symfony PHP controller forwards the route parameter directly to file_get_contents() without canonicalization or base-directory enforcement, making absolute filesystem paths such as /etc/passwd or application .env files fully retrievable within the PHP-FPM worker's permission boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session (CVSS PR:L confirmed); unauthenticated access to the endpoint is not supported by the available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the threat profile: network-reachable, low-complexity exploitation requiring only a valid user session, with high confidentiality impact and no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upstream fix available via two reviewed GitHub commits (fb9d3679d5b28977ef59e61c3eed42bec602ed8b and a0443570e105ed4835ce57f3c0a3e33d5b77418c); a formally tagged patched release version has not been independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all instances of Volmarg Personal Management System in production and review access logs for suspicious activity on the file retrieval endpoint. …

Threat intelligence, references, and detailed analysis are available after sign-in.