EUVD-2026-16947Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in elecV2 elecV2P up to 3.8.3. The affected element is the function path.join of the file /log/ of the component Wildcard Handler. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in elecV2P's wildcard handler allows unauthenticated remote attackers to read files outside intended directories via improper path validation in the /log/ endpoint, affecting versions up to 3.8.3. The vulnerability has a publicly available proof of concept and a CVSS score of 5.5 reflecting limited confidentiality impact. The vendor has not responded to early disclosure despite issue notification.
Technical ContextAI
The vulnerability exists in elecV2P's wildcard handler component, specifically in the path.join function used to process requests to the /log/ endpoint. The underlying issue is a classic path traversal flaw (CWE-22) where user-supplied input is not properly sanitized before being used in file path operations. An attacker can inject path traversal sequences (such as ../) to escape the intended log directory and access arbitrary files on the system. The path.join function, when used without proper validation of the resulting path against a whitelist or base directory, allows navigation outside the intended scope. This affects the entire elecV2P product line up to and including version 3.8.3 as indicated by the CPE specification cpe:2.3:a:elecv2:elecv2p:*:*:*:*:*:*:*:*.
RemediationAI
Users should upgrade elecV2P to a version newer than 3.8.3 once available. Since the vendor has not yet responded to the early disclosure notification and no patched version has been released, affected users should monitor the official elecV2P GitHub repository (https://github.com/elecV2/elecV2P/) for updates. As an interim mitigation, restrict network access to the /log/ endpoint using firewall rules or reverse proxy configuration to limit exposure to trusted networks only. Additionally, implement input validation and path canonicalization in any wrapper or proxy layer serving elecV2P, ensuring that requests cannot traverse parent directories. Users should avoid deploying vulnerable versions in production environments with sensitive data exposure risk until a patched version is released and validated.
Operating system command injection in elecV2P up to version 3.8.3 allows unauthenticated remote attackers to execute arb
Server-Side Request Forgery (SSRF) in elecV2P versions up to 3.8.3 allows unauthenticated remote attackers to manipulate
Path traversal in elecV2P up to version 3.8.3 allows unauthenticated remote attackers to read arbitrary files via manipu
Remote code execution in elecV2P up to version 3.8.3 allows authenticated attackers to inject arbitrary code via manipul
Reflected cross-site scripting (XSS) in elecV2P up to version 3.8.3 allows remote attackers to inject malicious scripts
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today