WookTeam CVE-2026-88394

Exploitation requires reaching the /api/project/task/export endpoint and supplying the 'data' parameter as a crafted JSON payload whose 'file' value includes path-traversal sequences (../); no path normalization or directory-boundary check is applied before the value is passed to storage_path() and streamed via response()->download(). Readable scope is limited to files accessible to the web-server process user. The primary limiting factor is access to the endpoint itself: because this is a project-task export route in a team-collaboration app, many deployments will require an authenticated session even though the NVD vector states PR:N - defenders should confirm whether their instance exposes this route pre-authentication. No special non-default configuration or user interaction is otherwise needed.

Signals conflict between high theoretical severity and low observed exploitation pressure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a remotely reachable, low-complexity, unauthenticated arbitrary-file-read scoring 7.5 (High) - a legitimately serious information-disclosure primitive that can expose Laravel .env secrets, DB credentials, and app source. Against that, the EPSS score is very low (0.21%, 11th percentile), the CVE is NOT in CISA KEV (no confirmed active exploitation), and a public write-up/PoC appears to exist (GitHub fangtang7/CVE 'fileread.md'), giving 'publicly available exploit code exists' but NOT active exploitation - these are distinct signals and should not be conflated. One important caveat: the PR:N (unauthenticated) rating should be verified. WookTeam is a team-collaboration/project-management application and /api/project/task/export is a project task endpoint that in most deployments sits behind a login/session, which would make real-world exploitation authenticated despite the NVD vector - verify with vendor/source. Net: a real but lower-priority issue - meaningful for exposed instances and worth patching, but EPSS and the absence of KEV suggest opportunistic/targeted rather than widespread exploitation, compounded by the product's niche footprint.

An attacker sends a crafted JSON 'data' payload to /api/project/task/export whose 'file' value contains directory-traversal sequences (e.g. ../../.env), and the server concatenates it into storage_path() and streams the file back via response()->download(). A public write-up/PoC exists, so weaponization is trivial; realistic targets are secrets and credentials readable by the web-server process. Low attack complexity means no special timing or configuration is needed, though a valid session may be required if the endpoint is authenticated in the deployment.