Omnispace Agora Project EUVD-2026-100575

Exploitation requires the attacker to control the tmpFolderName value in the file-upload destination path and to supply an unanchored traversal sequence; per the CVSS vector PR:L, a valid low-privileged authenticated account on the Agora Project web application is required (not unauthenticated). The traversal must resolve to a web-accessible directory (e.g. the web root) for the written file to be served and executed, so achieving RCE depends on the uploaded file type being executable in that location (typically a PHP/script-handling web root). Limiting factors: authentication is needed, so instances without open self-registration and with restricted account provisioning reduce exposure; versions 26.10.0 and later are not affected. No special non-default configuration is otherwise indicated - the flaw is in the upload path-handling logic itself.

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authenticated privileges and no user interaction, with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with the arbitrary-file-write-to-RCE outcome described. The score of 8.7 is credible. However, the key tempering signals are missing or negative: there is no CISA KEV listing and no public exploit code identified at time of analysis, so exploitation is not confirmed active. EPSS was not provided in the input and cannot be assessed. The main caveat is the PR:L requirement - an attacker needs a valid low-privileged account on the Agora Project instance, which meaningfully limits mass unauthenticated exploitation and shifts the realistic threat toward insiders, credential-abuse scenarios, or internet-exposed instances with open/weak registration. No SSVC decision data was supplied. Net: patch promptly, especially on internet-facing instances, but the absence of KEV/POC and the authentication requirement argue against this being widely weaponized today.

An attacker with a low-privileged authenticated account on an Agora Project instance before 26.10.0 submits a file upload while setting the tmpFolderName value to a path-traversal sequence (e.g. targeting the web root). The traversal causes the uploaded, attacker-controlled file to be written outside the intended temporary directory into a web-accessible location, which is then requested to achieve remote code execution. No public proof-of-concept exploit was identified at time of analysis, and the attack requires valid credentials.