EUVD-2026-42662
GHSA-7793-hmg3-gh57
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin save action (AV:N/AC:L) requires administrator privileges (PR:H) with no user interaction; arbitrary file write to RCE yields full C/I/A impact with no scope change.
Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).
CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725
Lifecycle Timeline
2DescriptionCVE.org
LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.
AnalysisAI
Authenticated remote code execution in LibreBooking (open-source scheduling/reservation platform) versions prior to 5.1.0 allows an administrator to write arbitrary files outside the intended template directory by abusing the email template editor's save action, which trusts the submitted template name as part of the destination file path. Because the resulting file can be dropped into a web-executable location, the write primitive escalates to server-side code execution. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but a CISA CSAF advisory and upstream fix commit exist.
Technical ContextAI
LibreBooking is a PHP-based room/resource booking application (a maintained successor to phpScheduleIt) whose administrative interface includes an email-template editor that persists templates to disk. The root cause is CWE-23 (Relative Path Traversal): the save handler concatenates the user-supplied template name into the destination file path without normalizing or constraining it, so sequences such as '../' let the attacker escape the templates directory. Since the application runs under a PHP interpreter and the write is attacker-controlled in both filename and content, an attacker can place a .php payload within the web root and have it executed, turning a path-traversal file write into full RCE.
RemediationAI
Vendor-released patch: upgrade to LibreBooking v5.1.0 or later (https://github.com/LibreBooking/librebooking/releases/tag/v5.1.0), which addresses the traversal in the template-save path (PR #1456 / commit cb9b7ad). If immediate upgrade is not possible, restrict access to the administrative interface - place the app behind a VPN or IP allowlist and limit the number of administrator accounts, since exploitation requires admin credentials; this reduces exposure at the cost of remote admin convenience. As a further compensating control, ensure the web server cannot execute scripts from the email-template storage directory (e.g., deny PHP handler execution in that path) and make the templates directory non-writable by the web user where feasible, accepting that this may break legitimate template editing until the patch is applied. Review admin account activity and rotate credentials if compromise is suspected.
Same weakness CWE-23 – Relative Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today