EUVD-2026-68920
GHSA-pg5x-hjq6-v5p3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint needs no authentication, but exploiting requires prior knowledge of valid server file paths (AC:H); impact is read-only disclosure (C:H, I:N, A:N).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the application's intended file system scope. Successful exploitation would require knowledge of valid file names and paths.
Depending on the privileges of the affected component, exploitation could result in the disclosure of sensitive information, including configuration files, environment settings, application assets, and log data.
The vulnerability has been remediated through enhanced path validation and secure path resolution controls that prevent access to unauthorised locations.
AnalysisAI
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation specifically targets the custom logo functionality's file path parameter - this is the exclusive attack surface identified in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 5.9 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Sage HRMS Q2 2026 Product Update, which contains the enhanced path validation and secure path resolution controls that remediate this vulnerability; the release notes are published at https://docs.sage.com/docs/en/customer/hrms/current/open/SageHRMS_PU_Q22026_RN.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files with
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Serve
A file disclosure vulnerability exists in Sage 1000 v7.0.0. Rated high severity (CVSS 7.2), this vulnerability is remote
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. Rated medium severity (CVSS 6.1),
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authen
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user r
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. Rated high severity (CVSS 7.2), this vulnerability is remot
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnera
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to in
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Rated medium
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today