NexoPOS EUVD-2026-109893

The only stated prerequisite is network reachability of the api/update endpoint on a NexoPOS v6.2.4 instance; the description provides no 'if configured' or feature-flag condition, and the trigger is not described in the available sources beyond 'Directory Traversal via api/update'. The CVSS vector asserts PR:N/UI:N (no authentication or user interaction), but because the affected surface is an 'api/update' endpoint that may require an authenticated session, authentication requirements are not confirmed from the available data - verify with the vendor. Limiting factors: exploitation is tied specifically to version 6.2.4, requires the api/update endpoint to be exposed/reachable, and the extent of impact (read vs. write) is not established in the sources.

Signals are mostly aligned toward high priority but rest on thin evidence. The vuln.today Decision label is act_now and the SSVC framework rates this Exploitation:poc, Automatable:yes, Technical Impact:total, which together argue for urgent remediation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity issue scored 9.8 with full C/I/A impact. However, several key corroborating signals are missing or weak: there is no EPSS exploitation-probability score provided, this CVE is NOT listed in CISA KEV (no confirmed active exploitation), and the only exploit artifact is a GitHub reference (raivenLockdown/CVE-2026-107092) that is a public PoC reference, not verified as working exploit code. The CVSS impact (C:H/I:H/A:H) is also optimistic for a generically described 'directory traversal' - classic path traversal typically yields file disclosure (C:H) while integrity/availability impact depends on whether the api/update endpoint performs writes, which the sources do not confirm. Note too that the api/update naming could imply an authenticated API path, but authentication requirements cannot be confirmed from the description and the CVSS vector asserts PR:N; verify with the vendor. Net: treat as act_now per the decision framework and SSVC automatable=yes, but recognize the real-world impact and auth preconditions are not independently substantiated.

A remote attacker sends a crafted request to the api/update endpoint of an internet-exposed NexoPOS v6.2.4 instance, embedding directory-traversal sequences to escape the intended path and reach arbitrary files on the server. Given AV:N/AC:L/UI:N, no user interaction or specialized conditions are described. A public PoC reference exists (GitHub raivenLockdown/CVE-2026-107092); it is not verified as working exploit code.