HUBzero CMS CVE-2026-92970

Requires an authenticated HUBzero project-member account (PR:L) with access to the project files upload feature; the attacker supplies directory-traversal sequences ('../') in the 'subdir' (and related upload/flowIdentifier) parameters of the com_projects file upload handlers (filesv1_0.php chunkedUploadTask, filefsv1_0.php uploadTask, and the projects/files plugin), which pre-patch flowed unsanitized into move_uploaded_file/copy and base64-derived temp directory paths. Exploitation is limited to HUBzero CMS versions through 2.2.32 and to users who already hold project membership; it is remote and needs no user interaction, but the write occurs with web server privileges and code execution depends on landing the file in a web-servable, executable location. No special non-default configuration is otherwise required.

This is a credible, high-severity issue that warrants prompt patching, but real-world urgency is tempered by narrow prevalence and an authentication gate. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, low-privilege (authenticated project member) path traversal that yields arbitrary file write with web server privileges - the source diff confirms the root cause: user-controlled 'subdir'/upload parameters were passed to move_uploaded_file/copy and base64-derived temp paths without confining them to the repo (fixed via new SafePath::relative/name guards across filesv1_0.php, filefsv1_0.php, repo.php and the files plugin). Arbitrary write of a PHP file into a web-served directory realistically escalates to code execution, justifying the H/H/H impact. Countervailing signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; exploitation requires a valid authenticated project-member account, making this an insider/compromised-account or chained scenario rather than mass-exploitable. Net: prioritize because of the RCE potential and available patch, but this is a targeted risk against a niche research-collaboration platform, not an internet-wide emergency. No SSVC or automatable determination was supplied in the input.

An authenticated HUBzero project member submits a file-upload API request (e.g. to the com_projects files controller) with a crafted 'subdir' parameter containing '../' traversal sequences, causing the uploaded file to be written outside the project repository to an attacker-chosen path with web server privileges. By writing a PHP payload into a web-accessible location, the attacker obtains a webshell and executes arbitrary code. No public exploit was identified at time of analysis, though the patch commits and referenced vulnerable source lines make the flaw straightforward to reconstruct.