EUVD-2026-95906
GHSA-7jr3-j3rm-rx7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin meeting as participant
-
DeliverySubmit whiteboard convert request with ../ filePath
-
ExploitServer converts target file to images
-
ExecutionFetch rendered pages via /download/uploadedFile/
-
ImpactRead disclosed server file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an authenticated meeting participant (PR:L) able to invoke the whiteboard document-conversion endpoint; the attacker supplies crafted ../ sequences in the filePath parameter so that arbitrary server files are rendered as page images, which are then retrievable (unauthenticated) through /download/uploadedFile/. The feature exercised is plugNmeet's text/office-document-to-whiteboard conversion. Limiting factors: the attacker must first obtain valid meeting participation, and only plugNmeet Server versions through 2.5.2 are affected; impact is confined to reading files readable by the server process (confidentiality only, no write or availability impact). |
| Impact | This is a moderate-priority confidentiality issue rather than a critical emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity attack requiring low privileges (PR:L) - consistent with the description's requirement that the attacker be an authenticated meeting participant. Impact is confidentiality-only (VC:H, no integrity or availability effect), matching arbitrary server-file disclosure via path traversal (CWE-22). A public POC exists (hackmd writeup and VulnCheck advisory), raising real-world exploitability, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation at this time. SSVC-style reading: exploitation is 'proof-of-concept', technical impact is partial (information disclosure, not total control), and automatability is limited because an attacker must first obtain valid meeting participation. Net: a genuine, credible vulnerability worth patching promptly for exposed plugNmeet deployments, but the required meeting-participant foothold and confidentiality-only impact keep it below top-tier urgency. No signals conflict here; the main missing data points are EPSS probability and any KEV status. |
| Exploit ScenarioDerived | An attacker who has joined a plugNmeet meeting (a legitimate low-privilege participant) submits a whiteboard document-conversion request with a filePath containing ../ sequences pointing at sensitive server files. The server converts the targeted text or office file into page images, which the attacker then retrieves unauthenticated via the /download/uploadedFile/ endpoint, exfiltrating arbitrary server file contents. A public proof-of-concept for this flow is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Path traversal in plugNmeet Server through 2.5.2 allows any authenticated meeting participant to read arbitrary files from the host by supplying crafted ../ sequences in the filePath value passed to the whiteboard document-conversion endpoint; the resulting page images are then retrievable without authentication via /download/uploadedFile/. The assessed impact is confidentiality-only (high file read, no write or availability effect) against the server process's readable files, and publicly available exploit code exists - though there is no CISA KEV listing, so this is best treated as a moderate-priority information-disclosure issue rather than a critical emergency. Risk is highest where the plugNmeet process can read secrets, configuration files, or credentials on the same host.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis; the disclosed boundary is 'through 2.5.2', so operators should check the plugNmeet-server repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/plugnmeet-server-through-2.5.2-path-traversal-via-api-whiteboard-convert) for a fixed release and upgrade as soon as one is published, treating any build above 2.5.2 as unverified until the vendor confirms it. Until then, the highest-value compensating control is to constrain who can reach the conversion endpoint: disabling or gating the whiteboard document-conversion feature (for example by restricting it to trusted presenters) removes the traversal primitive entirely, at the cost of losing document-to-whiteboard rendering for normal users. Second, run the plugNmeet server process under a dedicated low-privilege account with filesystem permissions scoped so it cannot read configuration, credential, or cloud-metadata files or host files outside its own data directory; this does not stop the traversal but flattens the disclosure surface, with the trade-off of possible breakage if the service legitimately reads shared paths. Third, add a reverse-proxy/WAF rule that rejects or normalizes URL-encoded and raw ../ (and %2e%2e) sequences in the filePath parameter of the whiteboard convert API, and alert on requests to /download/uploadedFile/ that reference paths outside the expected upload directory; note that fully blocking /download/uploadedFile/ would also break legitimate whiteboard image display, so prefer path validation and monitoring over a blanket deny. Finally, treat pre-2.5.2 exposure as a confidentiality incident if untrusted users were ever permitted to join meetings, and rotate any credentials or secrets that resided on the same host and were readable by the server process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
plugNmeet is a Go-based, self-hosted web conferencing server whose whiteboard feature converts uploaded text or office documents into page images for display. The conversion logic in pkg/models/file_convert.go (referenced at line 143) builds a filesystem path from a client-supplied filePath value without normalizing or constraining it to an expected upload directory, the classic CWE-22 path traversal root cause; ../ sequences therefore escape the intended root. Exploitation is a two-stage chain that the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) captures only partially: stage one requires a low-privileged authenticated context (a valid meeting participant able to invoke the conversion endpoint), and stage two deliberately drops the authentication requirement because the generated page images are served through /download/uploadedFile/ to unauthenticated requesters. The wildcard CPE cpe:2.3:a:mynaparrot:plugnmeet-server:*:*:*:*:*:*:*:* reflects that no fixed-version boundary is published in the data, with 2.5.2 named as the last affected release. Because rendering happens server-side, the traversal is not limited by meeting-level authorization and the disclosure surface equals whatever the server process's UID can read.
Know when Plugnmeet Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity; requires an authenticated meeting participant so PR:L; arbitrary file read gives C:H with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/.
Technical POC Analysis
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), in plugNmeet Server's own Go source, commit 961b4b01cdff655928fb4b4d50524b42a6b63ec1.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity path traversal flaw in plugNmeet Server (versions through 2.5.2) allows a meeting participant to read arbitrary files from the host through the whiteboard document-conversion endpoint, with the rendered page images then retrievable through a download endpoint on the same service. The practical danger is disclosure of configuration files, secrets, and credentials that the plugNmeet process can read, which could give an attacker a foothold for lateral movement into other systems. Publicly available exploit code exists, but there is no confirmed active exploitation, so this should be handled as an urgent information-disclosure remediation rather than a crisis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict the whiteboard document-conversion endpoint and the /download/uploadedFile/ path; block path-traversal sequences at the reverse proxy or WAF; run plugNmeet under a least-privilege account with restricted filesystem read scope; network-segment the host from sensitive systems; rotate any credentials or configuration secrets the service could read; and monitor for traversal attempts in conversion and download logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB