CVE-2026-7059

MediumCVSS 5.3

Published: 26/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

38th percentile - higher than 38% of all known CVEs

Summary

A vulnerability was found in 666ghj MiroFish up to 0.1.2. The get_simulation_posts function in backend/app/api/simulation.py (Query Parameter Handler component) allows path traversal via manipulation of the Platform argument. The attack can be initiated remotely and the exploit has been made public.

Risk Assessment

A remote attacker could exploit path traversal to access files outside the intended directory, potentially leading to data leakage or further system compromise. The risk affects MiroFish deployments at version 0.1.2 and earlier.

Recommendation

Update the project to the latest available version or implement validation of the Platform argument and restrict filesystem access. Monitor API traffic for path traversal attempts.

Other vulnerabilities in MiroFish

CVE-2026-7041Low
A vulnerability was detected in 666ghj MiroFish up to 0.1.2. An unknown function in the /console file of the Werkzeug Debugger PIN Handler component, when manipulating the SECRET argument, results in information disclosure. The attack can be initiated remotely, is highly complex, and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function get_simulation_posts of the file backend/app/api/simulation.py of the component Query Parameter Handler. Performing a manipulation of the argument Platform results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS