CRMEB CVE-2026-79426

Exploitation requires valid CRMEB administrator-level credentials, as stated explicitly in the CVE description ('authenticated attackers') and reflected in the PR:H metric of the CVSS vector. The vulnerable endpoint /adminapi/file/video_data_save must be network-reachable from the attacker's position (AV:N). No special non-default configuration of the feature is required - the endpoint is part of standard CRMEB v6.0.0 functionality. Exploitation is limited to files within the OS-level permissions of the PHP/web server process user; files owned exclusively by root or other system accounts not accessible to the web process cannot be deleted. The attack does not require user interaction beyond the administrator's own authenticated session.

The provided CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is partially overstated: the C:H metric is inconsistent with a pure file deletion primitive, which does not inherently expose confidential data. An independent assessment places C:N, yielding a lower effective score closer to 6.5. The PR:H requirement (admin credentials required) is a meaningful barrier that substantially limits the attack surface relative to an unauthenticated flaw. EPSS at 0.14% (4th percentile) confirms low community exploitation probability, and the vulnerability has not been added to CISA KEV. Even a mid-sized municipal IT team in sopot should treat this as a medium-priority patch item - urgent primarily in deployments where admin credentials are shared, poorly managed, or exposed to insider threat. The real-world risk escalates significantly if an attacker can chain this with a credential compromise: deletion of session files, configuration files, or authentication tokens could destabilize the application or force an insecure state. EPSS and KEV signals together suggest no widespread exploitation campaign is active.

An attacker who has obtained CRMEB administrator credentials - through phishing, credential stuffing, or a previously compromised session - sends a POST request to /adminapi/file/video_data_save with a path traversal payload (e.g., ../../config/database.php or a critical session storage file) embedded in the request body. The endpoint resolves the path without confinement and deletes the targeted file, potentially corrupting the application's database connection configuration or authentication state. This could be used to force a re-setup flow, lock out legitimate administrators, or permanently damage application data.