CVE-2026-19827
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A path traversal vulnerability was found in alldatacenter alldata up to 0.6.8, affecting the FileInputStream function in /admin/controller/JobLogController.java of the logDetailCat Endpoint. Manipulation of the executorAddress argument allows remote attacks. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely read arbitrary files on the server, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
Update alldata to a version newer than 0.6.8 or apply available patches immediately. Also restrict access to the logDetailCat endpoint.
Original NVD description (English source)
A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project closed the issue report as "not planned" without any further explanation.