Which versions of Elecv2P are affected by CVE-2026-5013?

Organizations using elecV2 elecV2P should be aware of moderate risk from CVE-2026-5013, a path traversal vulnerability rated CVSS 5.5. This could allow unauthorized file access.

Is there a public PoC exploit available for CVE-2026-5013?

Yes, a public proof-of-concept exploit is available for CVE-2026-5013. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5013?

Within 30 days: Identify affected systems running elecV2 elecV2P and apply vendor patches as part of regular patch cycle. Review file handling controls.

Elecv2P CVE-2026-5013

Q: What is the CVSS score of CVE-2026-5013?

CVE-2026-5013 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16945 MEDIUM

Path Traversal (CWE-22)

2026-03-28 VulDB

GHSA-h9hm-gx5c-xfc2

Path Traversal Elecv2P Elecv2

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 28, 2026 - 20:15 euvd

EUVD-2026-16945

Analysis Generated

Mar 28, 2026 - 20:15 vuln.today

CVE Published

Mar 28, 2026 - 20:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in elecV2 elecV2P up to 3.8.3. Impacted is the function path.join of the file /store/:key. The manipulation of the argument URL leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in elecV2P up to version 3.8.3 allows unauthenticated remote attackers to read arbitrary files via manipulation of the URL argument in the /store/:key endpoint's path.join function. The vulnerability has a CVSS score of 5.5 with low confidentiality impact, publicly available exploit code exists, and the vendor has not responded to early notification through an issue report.

Technical ContextAI

The vulnerability exists in the /store/:key endpoint of elecV2P, where improper input validation on the URL parameter passed to the path.join function fails to sanitize path traversal sequences (such as ../ or absolute paths). This is a classic CWE-22 path traversal flaw where user-controlled input is used to construct file system paths without adequate canonicalization or validation. The affected product is elecV2P (CPE: cpe:2.3:a:elecv2:elecv2p:*:*:*:*:*:*:*:*), a Node.js-based project, making it vulnerable on any system where the application is deployed. An attacker can exploit this by crafting malicious URLs containing traversal sequences to access files outside the intended /store directory.

RemediationAI

Upgrade elecV2P to a version later than 3.8.3 if a patched release becomes available. Currently, no vendor-released patch has been confirmed at the time of analysis, despite early notification to the project. Until an official patch is released, implement network-level access controls to restrict access to the /store/:key endpoint, or disable the endpoint if it is not essential to your deployment. Monitor the official GitHub repository (https://github.com/elecV2/elecV2P) for security updates and consider contributing to or monitoring the open issue #199 (https://github.com/elecV2/elecV2P/issues/199) for vendor response and patch availability.