What is the CVSS score of CVE-2026-49488?

CVE-2026-49488 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Apache OpenMeetings are affected by CVE-2026-49488?

Apache OpenMeetings 5.0.0-9.0.x contains an arbitrary file read vulnerability allowing room moderators to extract server credentials and secrets via the WhiteBoard download endpoint.. A patch is available.

How to fix or mitigate CVE-2026-49488?

Within 24 hours: Identify all internet-exposed OpenMeetings instances running versions 5.0.0-9.0.x and immediately restrict room moderator role assignments to essential trusted users only; enable detailed logging and alerting on the WhiteBoard download endpoint (/download) to detect directory traversal attempts. Within 7 days: Conduct a full audit of all moderator-assigned users and revoke moderator access for inactive or suspicious accounts; review server logs for evidence of unauthorized credential file access or directory traversal attempts. Within 30 days: Implement network segmentation to restrict OpenMeetings access to internal networks only; establish a daily monitoring routine for Apache OpenMeetings security advisories; develop a contingency migration plan to alternative collaboration platforms if vendor patching becomes unavailable.

Apache OpenMeetings CVE-2026-49488

EUVD-2026-43666 MEDIUM

Path Traversal (CWE-22)

2026-07-14

GHSA-436m-m73c-vq4g

Apache Path Traversal Openmeetings

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTTP request; PR:L for required room moderator privilege; read-only impact so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

CVSS changed

Jul 14, 2026 - 17:07 NVD

6.5 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 10:18 vuln.today

CVE Published

Jul 14, 2026 - 09:57 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Arbitrary file read in Apache OpenMeetings 5.0.0 through 9.0.x allows any room moderator to exfiltrate files accessible to the OS account running the server, including credentials and secrets, via a crafted download request to the WhiteBoard download service. The vulnerability stems from insufficient path validation in the WB download endpoint, enabling directory traversal outside the intended file scope. No active exploitation has been confirmed (not in CISA KEV), but the ability to read credential files makes this high-priority for any internet-exposed deployment where moderator access is not tightly controlled.

Technical ContextAI

Apache OpenMeetings is an Apache Software Foundation open-source web conferencing platform supporting audio/video conferencing, whiteboard collaboration, and file sharing across rooms. The vulnerability resides in the WhiteBoard (WB) download service component, which handles file download requests from room participants. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the download endpoint fails to adequately canonicalize or restrict the requested file path to a sanctioned directory, allowing a crafted request to traverse the directory structure and access arbitrary files readable by the JVM process account. The Jira ticket OPENMEETINGS-2821 confirms the component is the WB download service and that checks on download requests were 'insufficient'. The affected version range spans 5.0.0-M3 (milestone) through all releases before 9.1.0, covering a multi-year window of exposure.

RemediationAI

Upgrade Apache OpenMeetings to version 9.1.0, which was released on 2026-07-08 and explicitly fixes CVE-2026-49488 by adding additional security checks in the WB download service. The upgrade is the only confirmed remediation; the vendor advisory at https://openmeetings.apache.org/ and the Jira issue https://issues.apache.org/jira/browse/OPENMEETINGS-2821 confirm the fix. If an immediate upgrade is not feasible, restrict network access to the OpenMeetings instance to only trusted users or internal networks, reducing the pool of potential room moderators. Additionally, audit and restrict the OS account running the OpenMeetings server to the minimum file permissions necessary, limiting the blast radius of any traversal attempt. Revoke moderator privileges from untrusted or self-registered users until the patch is applied. Note that Java 21 and KMS 7.3.0 or later are required for version 9.1.0, so ensure prerequisites are met before upgrading.