MoTranslator EUVD-2026-116104

Exploitation requires the integrating application to pass attacker-influenced input into the 'locale' argument of Loader::getTranslator; the flaw is in the MoTranslator library (versions up to 6.0.1), not a standalone network service, so reachability depends on the host application wiring 'locale' to remote request data. The CVSS vector sets PR:L, so some authenticated/low-privilege access is needed, and the precise injection mechanics beyond manipulating 'locale' are not described in the available sources. Limiting factors: PR:L authentication requirement, dependence on the consuming application exposing the locale parameter, and low impact (information disclosure via loading an out-of-tree translation file rather than code execution). No fixed version is listed in the available data and the vendor did not respond.

This is a moderate-severity path traversal (CWE-22) with a mixed, mostly low-urgency signal set. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a remotely reachable, low-complexity flaw that nonetheless requires low-level privileges (PR:L), so it is not an unauthenticated internet-wide issue. Impact is rated low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no scope change, yielding a base score of 5.3 - consistent with limited file-read style disclosure rather than code execution. The vuln.today decision label is 'this_month', not act_now or emergency, and there is no CISA KEV listing, so this is not confirmed active exploitation. Exploit maturity is E:P (proof-of-concept): a public PoC reference exists but it is not verified as working exploit code. No EPSS score was provided, so widespread-exploitation probability cannot be quantified. Net: a real but non-emergency issue - schedule remediation this cycle rather than treating it as a drop-everything priority. One caveat to verify: this is a library (MoTranslator), so whether AV:N and PR:L actually hold depends on how the consuming application exposes the 'locale' argument to remote input; the CVE's own trigger mechanics beyond 'manipulation of the locale argument' are not described in the available sources.

A remote attacker with low-level privileges supplies a crafted 'locale' value containing directory-traversal sequences to Loader::getTranslator in src/Loader.php, causing MoTranslator to resolve and load a translation (.mo) file from outside the intended translations directory. A public PoC reference exists but is not verified as working exploit code. Per the CVSS vector this needs low attack complexity and no user interaction, but does require PR:L authentication.