CVE-2026-1186
Unknown Unknown - Not Provided

Path Traversal in EAP Legislator Zipx Extraction Enables Arbitrary File Write

Publication date: 2026-02-02

Last updated on: 2026-02-02

Assigner: CERT.PL

Description
EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (default file type used by the Legislator application) and choose arbitrary path outside the intended directory (e.x. system startup) where files will be extracted by the victim upon opening the file. This issue was fixed in version 2.25a.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-02
Last Modified
2026-02-02
Generated
2026-07-06
AI Q&A
2026-02-02
EPSS Evaluated
2026-07-05
NVD
CVE-2026-1186
EUVD
EUVD-2026-5103

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
abcp legislator to 2.25 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-1186 is a Path Traversal vulnerability in the EAP Legislator software's file extraction functionality. An attacker can create a malicious zipx archive with file paths that point outside the intended extraction directory. When a victim opens this archive, files can be extracted to arbitrary locations on the system, such as system startup folders, potentially allowing unauthorized file placement. [2]

Impact Analysis

This vulnerability can lead to unauthorized files being placed and potentially executed in sensitive locations on a victim's system, such as system autostart folders. This could allow attackers to execute malicious code, compromise system integrity, or persist on the system without the user's knowledge. [2]

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the EAP Legislator software to version 2.25a or later, where the path traversal issue in the file extraction functionality has been fixed. [2]

Compliance Impact

[{'type': 'paragraph', 'content': "The vulnerability allows an attacker to extract files to arbitrary locations on the victim's system, including sensitive directories such as system startup folders. This unauthorized file placement and potential execution could lead to compromise of system integrity and confidentiality."}, {'type': 'paragraph', 'content': 'Such unauthorized access and potential data manipulation may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity, confidentiality, and secure system operations.'}, {'type': 'paragraph', 'content': 'However, the provided information does not explicitly detail the direct effects on compliance with these standards.'}] [2]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart