volotat Anagnorisis EUVD-2026-86305

Requires an authenticated account on the Anagnorisis instance (CVSS PR:L) with access to the file page.html functionality; the attacker then supplies a path-traversal payload to any of the get_file_content, save_file_content, move_files, or start_streaming handlers to escape the intended media directory. Exploitation is remote and needs no user interaction (AV:N/UI:N). Limiting factors: valid credentials are required, the product is a niche self-hosted deployment, and no fixed version is available so only reachable instances with authenticated attackers are at risk. The read handlers enable file disclosure while save/move handlers enable arbitrary file write/relocation.

This is a MEDIUM-severity path traversal (CWE-22) rated CVSS 4.0 5.3 by VulDB, the sole reporting source. The 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, E:P) indicates a remote but authenticated (PR:L) attacker with low complexity achieving low confidentiality, integrity, and availability impact across the affected file-handling functions. The E:P (Proof-of-Concept) exploit maturity is corroborated by a publicly available exploit reference (note-hxlab), so publicly available exploit code exists - but this is NOT confirmed active exploitation: there is no CISA KEV listing and no EPSS score was provided. The signals are internally consistent (low-privilege remote traversal, partial impacts, PoC-stage) rather than conflicting. Real-world priority is tempered by two factors: (1) the affected product, volotat Anagnorisis, is an obscure self-hosted OSS media/recommendation app with a tiny deployment footprint, and (2) exploitation requires an authenticated account. One caveat worth verifying: the affected functions include save_file_content and move_files, which are WRITE/MOVE operations - arbitrary file write via traversal can escalate beyond the VulDB-assigned VI:L (potentially to code execution or config overwrite), so the integrity impact may be understated. Overall this is a real but low-urgency issue for the small population actually running Anagnorisis; the vendor did not respond and no fixed version is published, which raises the residual exposure for existing deployments.

An authenticated low-privilege user of an Anagnorisis instance submits a crafted file path containing traversal sequences (e.g. ../../) to the get_file_content, save_file_content, move_files, or start_streaming handlers, causing the server to read, overwrite, move, or stream files outside the intended media directory. A public proof-of-concept exists (note-hxlab reference), lowering the barrier to reproduction. Because the CVSS vector is AV:N/AC:L/PR:L, this is a straightforward remote request from any valid account against the file page endpoints.