Liman MYS EUVD-2026-85857

Requires network access to a reachable Liman MYS web interface running an affected version (2.3.2 up to but not including 2.3.4-1124). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, or user interaction is needed, so an exposed default instance is directly exploitable; the practical limiting factor is that impact is confined to limited file-read confidentiality (C:L, no write/integrity or availability effect) and that Liman MYS has a small, regionally concentrated deployment base, reducing the pool of exposed targets.

This is a genuine but modest-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 MEDIUM) describes a network-reachable, low-complexity, unauthenticated path traversal whose only impact is limited confidentiality (C:L) with no integrity or availability effect - consistent with reading a bounded set of files rather than arbitrary full-system disclosure. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals all point to a real-but-not-urgent flaw rather than a high-impact emergency. The main mitigating factor against widespread exploitation is the product's narrow deployment footprint (Liman MYS is a niche, largely Turkey-focused server management system) rather than any technical barrier - the flaw itself is trivially reachable if an instance is exposed. No signals conflict; the chief limitation is the terse advisory, which does not specify which files or directories are exposed, so the precise sensitivity of leaked data cannot be confirmed from available data.

An attacker who can reach a Liman MYS instance's web interface sends a crafted HTTP request containing directory-traversal sequences (e.g., ../) in a path parameter, causing the application to read and return files outside its intended directory. Because the CVSS vector is PR:N/UI:N, no authentication or victim interaction is required, but the C:L rating indicates only limited file content is exposed. No public proof-of-concept was identified at time of analysis.