Is there a public PoC exploit available for CVE-2026-8736?

Yes, a public proof-of-concept exploit is available for CVE-2026-8736. Prioritise patching immediately. EPSS: 0.0%.

Oinone Pamirs CVE-2026-8736

Q: What is the CVSS score of CVE-2026-8736?

CVE-2026-8736 has a CVSS 4.0 base score of 0.9 (Low). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30685 LOW

Path Traversal (CWE-22)

2026-05-17 VulDB

GHSA-frwq-5cw2-vg5w

Path Traversal Java

0.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

0.9 LOW

CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 17, 2026 - 07:29 vuln.today

Severity Changed

May 17, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 07:22 NVD

4.1 (MEDIUM) 0.9 (LOW)

DescriptionCVE.org

A security flaw has been discovered in Oinone Pamirs up to 7.2.0. This vulnerability affects the function request.getParameter of the file LocalFileClient.java of the component RestController. Performing a manipulation of the argument uniqueFileName results in path traversal. The attack may be carried out on the physical device. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in Oinone Pamirs versions up to 7.2.0 allows authenticated local attackers with physical device access to read, write, or delete arbitrary files via manipulated uniqueFileName parameter in LocalFileClient.java RestController endpoint. Publicly available exploit code exists (GitHub POC published). Despite low CVSS 4.0 score (0.9), the physical access requirement and low attack complexity make this exploitable in scenarios where attackers have direct device access or console privileges. EPSS data not available for this CVE. Vendor unresponsive to disclosure.

Technical ContextAI

This is a CWE-22 path traversal vulnerability in a Java-based file management component. The flaw exists in the LocalFileClient.java file within a Spring-based RestController that handles file operations. The vulnerability stems from insufficient input validation on the uniqueFileName parameter processed by request.getParameter(), allowing directory traversal sequences (../ patterns) to escape intended file access boundaries. According to CPE data (cpe:2.3:a:oinone:pamirs), Oinone Pamirs is the affected product. Path traversal vulnerabilities occur when applications construct file paths using unvalidated user input, enabling attackers to access files outside the intended directory structure by manipulating relative path components.

RemediationAI

No vendor-released patch identified at time of analysis - Oinone did not respond to early disclosure attempts per VulDB report. In absence of official patch, implement these SPECIFIC compensating controls: (1) Add server-side input validation to LocalFileClient.java uniqueFileName parameter processing using Path.normalize() and Path.startsWith() checks to prevent directory traversal sequences, rejecting any input containing '../', absolute paths, or characters outside [a-zA-Z0-9._-]. Trade-off: May break legitimate use cases requiring special filename characters. (2) Implement strict file access ACLs at OS level limiting the application service account to read/write only within designated working directories using chroot jails or containerization. Trade-off: Requires infrastructure changes and may complicate deployment. (3) PHYSICAL SECURITY: Since AV:P requires physical access, strengthen physical device security through locked server rooms, console access controls, full-disk encryption, and BIOS/bootloader passwords to prevent unauthorized local access. Trade-off: Does not fix the code flaw but eliminates the attack vector. (4) Deploy application behind authentication requiring multi-factor authentication for any local console or physical access. Monitor all file access patterns for anomalous traversal attempts. Exploit code available at https://github.com/SourByte05/SourByte-Lab/issues/14 - review for defensive insight.