Is there a public PoC exploit available for CVE-2026-5638?

Yes, a public proof-of-concept exploit is available for CVE-2026-5638. Prioritise patching immediately. EPSS: 0.0%.

Cppwebframework CVE-2026-5638

Q: What is the CVSS score of CVE-2026-5638?

CVE-2026-5638 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19205 MEDIUM

Path Traversal (CWE-22)

2026-04-06 VulDB

GHSA-gmx4-p9gm-fxcw

Path Traversal Cppwebframework

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 09:00 euvd

EUVD-2026-19205

Analysis Generated

Apr 06, 2026 - 09:00 vuln.today

CVE Published

Apr 06, 2026 - 08:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in HerikLyma CPPWebFramework up to version 3.1 allows remote attackers to read arbitrary files on the server with low confidentiality impact. The vulnerability requires no authentication and can be exploited over the network with low complexity; publicly available exploit code exists. The vendor has been notified via GitHub issue but has not yet responded or released a patch.

Technical ContextAI

HerikLyma CPPWebFramework is a C++ web application framework used to build server-side web applications. The vulnerability stems from improper input validation in the framework's request processing logic (CWE-22: Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'). An attacker can manipulate input parameters passed to the framework to escape from the intended file directory and access files elsewhere on the filesystem. The affected CPE cpe:2.3:a:heriklyma:cppwebframework:*:*:*:*:*:*:*:* indicates all versions up to at least 3.1 are vulnerable. The low CVSS attack complexity (AC:L) suggests the traversal can be achieved with straightforward input manipulation without requiring special encoding or race conditions.

RemediationAI

No vendor-released patch identified at time of analysis. Users of CPPWebFramework should monitor the GitHub repository (https://github.com/HerikLyma/CPPWebFramework/) and the associated issue (https://github.com/HerikLyma/CPPWebFramework/issues/40) for vendor response and patched release versions. In the interim, implement network-level access controls to restrict direct exposure of the web application to untrusted networks, disable file serving functionality if not required, and apply input validation filters on the application side to reject path traversal attempts (e.g., blocking sequences such as '../' and null bytes). Organizations should consider evaluating alternative web frameworks with more mature security practices until the vendor addresses this issue or a patched version becomes available.