CVE-2026-102249
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.
Risk Assessment
A remote attacker can gain unauthorized access to file editor functionality, potentially leading to modification or deletion of files in the system.
Recommendation
Update REBUILD to a patched version and implement proper authorization mechanisms for file access.
Other vulnerabilities in REBUILD
See all- CVE-2026-111667Medium
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
- CVE-2024-25294Critical
An SSRF vulnerability in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload, and URL parameters.
- CVE-2026-110611Medium
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
- CVE-2026-102248High
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5 in an unknown part of the /user/login file of the Login Endpoint component. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-71802Medium
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
- CVE-2025-11276Low
A cross-site scripting vulnerability was discovered in an unknown function of the Comment/Guestbook component in Rebuild up to version 4.1.3. The attack can be initiated remotely, and version 4.1.4 contains the fix.
Original NVD description (English source)
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS