Directory Traversal in NexoPOS v6.2.4

Executive Summary

CVE-2026-107092 is a high-severity Directory Traversal vulnerability in NexoPOS v6.2.4 and earlier. It affects the unauthenticated /api/update endpoint, which is meant for database migrations but lacks security controls. The endpoint accepts a client-supplied filename without validation, allowing path traversal sequences like ../../../../ to escape the modules/ directory. This enables arbitrary PHP file inclusion via the require() function, leading to remote code execution with web server privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if the /api/update endpoint is accessible without authentication by sending a GET request to the endpoint. Look for path traversal patterns in requests to this endpoint, such as sequences like ../../../../. Use tools like curl or Burp Suite to inspect HTTP requests for suspicious file inclusion attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server hosting NexoPOS. They can include malicious PHP files outside the intended directory, run system commands, and even establish a reverse shell. This could lead to full system compromise, data theft, or further network infiltration depending on the server's configuration and privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful exploit could lead to data breaches, resulting in legal penalties, reputational damage, and loss of trust. Immediate patching is critical to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade NexoPOS to version 6.3.0 or apply the security-only backport for 6.2.5. Ensure the /api/update endpoint is restricted to authenticated users only. Review and audit custom modules for any signs of compromise. Back up all critical data before applying updates.

Useful 0 Not Useful 0