sar2html EUVD-2026-101559

Exploitation targets the updateDb function in sar2html.py's File Upload component, which must be reachable and actively serving upload requests; the attacker supplies traversal sequences in the upload path/filename to escape the intended storage directory. Per the CVSS 4.0 vector (PR:N/UI:N/AT:N) no authentication, user interaction, or special attack prerequisites are required, so a running, network-exposed sar2html 4.0.0 instance is the primary condition. The chief limiting factors are the product's rarity and the constrained impact (VC:N, only VI:L/VA:L), meaning the service must actually be deployed and internet- or network-reachable, and a successful attack yields limited file-integrity/availability effect rather than confidentiality loss or code execution; no vendor patch is available, so mitigation currently depends on restricting network access to the application.

This is a medium-severity (CVSS 4.0 base 6.9) path traversal in the file-upload handling of an obscure open-source utility, and the available signals converge on low real-world urgency rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is reachable remotely with low complexity and no authentication or user interaction, which raises the theoretical attack surface; however, the impact metrics are deliberately constrained (VC:N, VI:L, VA:L), meaning no confidentiality loss and only limited integrity/availability effect - consistent with an arbitrary-file-write/traversal rather than full code execution or data theft. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The disclosure is CNA-sourced from VulDB and the vendor has not responded to the issue report, so no patch exists, which modestly increases exposure window - but the product's tiny footprint and the limited technical impact keep aggregate risk low. The CVSS 4.0 vector and the description agree (both point to a remote, low-impact file-handling flaw), so there is no notable signal conflict; the main uncertainty is the absence of exploitability telemetry (EPSS/KEV/POC all unstated, which is absence of data, not evidence of safety).

A remote, unauthenticated attacker sends a crafted file-upload request to the updateDb function in sar2html.py, embedding directory-traversal sequences (e.g. ../) in the filename or path parameter so the uploaded content is written outside the intended directory. Because CVSS shows AV:N/AC:L/PR:N/UI:N, this requires only network reach to the running service and no credentials or victim interaction; the limited VI:L/VA:L impact means the realistic outcome is overwriting or planting files to corrupt data or disrupt the tool rather than immediate full compromise. No public proof-of-concept exploit was identified in the provided data.