EUVD-2026-72460
GHSA-29jq-798g-w68h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network path traversal with read-only file disclosure; no integrity or availability impact confirmed.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal.
This issue affects CSM (Customer Service Management): from 6.8.9 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated path traversal in Next4Biz CSM (Customer Service Management) versions 6.8.9 through 07092026 allows remote attackers to read arbitrary files from the server filesystem with no credentials required. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 7.5 with a network-accessible, zero-interaction vector, meaning any internet-reachable deployment is potentially exposed to full confidentiality compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions required - unauthenticated remote exploitation against any network-accessible Next4Biz CSM instance running versions 6.8.9 through 07092026 (CVSS PR:N/AC:L/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score and AV:N/AC:L/PR:N/UI:N vector indicate a straightforward, automatable, unauthenticated network attack with no special configuration preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to TR-CERT's coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and isolate all internet-accessible Next4Biz CSM instances running versions 6.8.9 through 07092026; immediately move them behind a VPN gateway or private network to deny unauthenticated remote access, and escalate to Next4Biz vendor support for patch timeline confirmation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today