CVE-2026-104806

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: Switzerland Government Common Vulnerability Program

Description

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure. By exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104806

EUVD

EUVD-2026-92293

Affected Vendors & Products

Vendor	Product	Version / Range
Mitel	Mitel	MiVoice Office 400 11.0.96.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-31	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in DigitalCanion's web management portal. It allows attackers to access files outside the intended directory by manipulating file paths in the Maintenance → System Logs section. The flaw exists because the application does not properly validate user-supplied paths.

Detection Guidance

Check web server access logs for unusual requests to the Maintenance → System Logs functionality. Look for paths containing '..' or absolute file paths. Test with crafted requests like 'https://<target>:443/maintenance/system_logs?file=../../../../etc/passwd' to see if sensitive files are exposed.

Impact Analysis

An attacker could exploit this to access and download sensitive system or application files outside the intended logs directory. This may lead to unauthorized data exposure, system compromise, or further attacks depending on the accessed files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, potentially exposing personal or confidential data. This may violate GDPR if personal data is accessed without authorization and HIPAA if protected health information is compromised.

Mitigation Strategies

Apply input validation to restrict file paths to the intended system logs directory. Update the web application to reject requests containing path traversal sequences like '..'. Restrict access to the Maintenance → System Logs feature to authorized users only.

Hi! I’m here to help you understand CVE-2026-104806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70