LubeLogger CVE-2026-62278

Requires a valid authenticated LubeLogger account of any privilege level - notably a NON-administrative user suffices, which is the core weakness. The attacker must reach the HandleTranslationFileUpload endpoint (translation file upload feature) and supply a crafted upload file name; the pre-1.6.8 RenameFile routine performs string-replacement path construction with no absolute-path containment check against the web root/data directory. Limiting factors: authentication is mandatory (not exploitable pre-auth), the target must run a version prior to 1.6.8, and impact is bounded by the file-system permissions of the application process. No special non-default configuration is otherwise needed. The fix adds an [Authorize(Roles=IsRootUser)] restriction, so patched instances gate the upload path to admins.

This is a genuine post-authentication file-write vulnerability that warrants prompt patching but sits below the 'drop everything' tier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 8.1) correctly reflects a network-reachable, low-complexity path with NO user interaction, but it requires an authenticated account (PR:L) - and specifically only a non-administrative one, which is the noteworthy part since it crosses a privilege boundary the app intended to enforce. Exploitation signals are otherwise quiet: no EPSS score, no KEV listing, and no public exploit is referenced (only a GitHub Security Advisory, issue, PR, and fix commit). So there is no public exploit identified at time of analysis and no confirmed active exploitation. The vendor's C:H/I:H rating is partly questionable: the described primitive is moving/overwriting an uploaded file outside the storage directory, which is fundamentally an INTEGRITY issue (unauthorized file placement/overwrite). C:H (confidentiality) is not well supported by the description - there is no read/disclosure primitive shown - so the raw 8.1 likely overstates confidentiality impact. The real risk is an authenticated tenant writing/overwriting files as the application process, which on a self-hosted app can escalate toward code execution or data corruption depending on what gets overwritten.

An attacker who holds any ordinary (non-admin) LubeLogger account logs in and submits a translation file upload to HandleTranslationFileUpload with a maliciously crafted file name containing traversal sequences. Because RenameFile builds the destination path with naive string replacement and never confirms the resolved absolute path stays under the web root or data directory, the uploaded file is moved to an attacker-chosen location, overwriting or planting a file with the application process's privileges. No public proof-of-concept is referenced in the provided data.