CVE-2026-107092
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.
Risk Assessment
An attacker could exploit the vulnerability to read or manipulate files outside the permitted directory, potentially leading to data disclosure or unauthorized operations.
Recommendation
Upgrade NexoPOS to a patched version. Implement path validation in the api/update endpoint to prevent traversal.
Other vulnerabilities in NexoPOS
See all- CVE-2026-111637Medium
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
- CVE-2026-117606Medium
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
Original NVD description (English source)
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS