Is CVE-2026-116067 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116067?

CVE-2026-116067 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2026-116067

Description

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.