MicroRealEstate CVE-2026-57871

Q: What is the CVSS score of CVE-2026-57871?

CVE-2026-57871 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42008 HIGH

Relative Path Traversal (CWE-23)

2026-07-07 vdp@themissinglink.com.au

GHSA-56qr-p95w-94vh

Path Traversal File Upload

7.1

CVSS 4.0 · Vendor: themissinglink

Severity by source

Vendor (themissinglink) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable upload feature (AV:N/AC:L) requires a low-privilege account (PR:L) and no interaction; arbitrary file overwrite yields low integrity and high availability impact with no confidentiality loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (themissinglink).

CVSS VectorVendor: themissinglink

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jul 07, 2026 - 06:38 cve.org

HIGH 7.1

Analysis Generated

Jul 07, 2026 - 06:37 vuln.today

DescriptionCVE.org

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.

This issue affects MicroRealEstate: through 1.0.0-alpha3.

AnalysisAI

Relative path traversal in the MicroRealEstate file upload functionality lets an authenticated low-privilege user supply crafted filenames containing directory-traversal sequences to write outside the intended upload directory and potentially overwrite system files. All releases through 1.0.0-alpha3 are affected. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven primarily by high availability impact.

Technical ContextAI

MicroRealEstate is an open-source, self-hosted property/real-estate management platform (Node.js microservices with a web front end) used to manage tenants, leases, and documents. The vulnerability is classified as CWE-23 (Relative Path Traversal), a root-cause class where user-controlled input embedded in a file path is not properly canonicalized or constrained, so sequences such as '../' escape the intended base directory. Here the untrusted input is the filename/target path handled by the document/file upload feature; because the application resolves the destination relative to a base directory without neutralizing traversal sequences, an attacker can steer the write to an arbitrary location on the server filesystem.

RemediationAI

No vendor-released patch identified at time of analysis - the input lists the affected range 'through 1.0.0-alpha3' but no fixed version, and the references point to the project repository and the reporter advisory rather than a tagged patched release; monitor https://github.com/microrealestate/microrealestate and https://www.themissinglink.com.au/security-advisories/cve-2026-57871 for a fix and upgrade as soon as one is published. Until then, enforce server-side filename sanitization that strips or rejects path separators and '../' sequences and canonicalizes the resolved path to confirm it stays within the intended upload directory (trade-off: requires a code or reverse-proxy fix and may reject unusual but legitimate filenames); run the upload/storage service as an unprivileged user on a dedicated, non-executable filesystem mount so an escaped write cannot clobber OS or application binaries (trade-off: deployment change, and it does not protect files that user can still write); and restrict access to the upload endpoint by tightening account provisioning and placing the feature behind stricter authorization or network ACLs (trade-off: may block legitimate low-privilege users who need to upload documents).