EUVD-2026-52649
GHSA-v8cj-x2cf-86x7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint requires low-privilege authentication (PR:L); read-only file disclosure yields high confidentiality impact with no write capability or service disruption.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
AnalysisAI
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary files from the server filesystem without any user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account - consistent with a standard HR system employee login - with high confidentiality impact and no integrity or availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector PR:L confirms that a valid low-privilege user account in the HUMANIST HR application is required - unauthenticated external actors cannot directly exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 6.5 (Medium) reflects the PR:L authentication barrier that prevents fully unauthenticated exploitation, which meaningfully constrains the attacker population to those holding valid HUMANIST HR credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a valid HUMANIST HR user account - whether through phishing, credential stuffing, or insider access - submits a crafted HTTP request containing path traversal sequences (e.g., `../../etc/shadow` or `../../../app/config.yml`) to a file-access endpoint in the application. The server fails to normalize the supplied path and reads the file from the underlying OS filesystem, returning its contents to the attacker. … |
| Remediation | Upgrade to HUMANIST Digital Human Resources version 26.1 or later, as the version range 'from 26.0 before 26.1' implies the fix is introduced in 26.1 - though this version is inferred from the CVE description and has not been independently confirmed via a vendor changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticat
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human R
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive s
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persiste
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to cr
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account f
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today