CVE-2026-125385
MediumCVSS 6.5Summary
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
Risk Assessment
An authenticated attacker can read sensitive configuration files such as appsettings.json, potentially leading to disclosure of credentials and further privilege escalation.
Recommendation
Update INDOTALENT WHMS to version 10.20261109 or later. Additionally, consider restricting self-registration and validating paths in the documentName and imageName parameters.
Other vulnerabilities in INDOTALENT WHMS
See all- CVE-2026-125384Critical
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability because the UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
- CVE-2026-125383Critical
INDOTALENT WHMS before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Original NVD description (English source)
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS