CVE-2026-2753
Absolute Path Traversal in Navtor NavBox Allows File Disclosure
Publication date: 2026-03-06
Last updated on: 2026-03-10
Assigner: MHV
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| navtor | navbox | 4.12.0.3 |
| navtor | navbox | 4.16.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-36 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2753 is an absolute path traversal vulnerability in Navtor NavBox version 4.12.0.3. It occurs because the application exposes an HTTP service that does not properly sanitize user-supplied path input.
This flaw allows unauthenticated remote attackers to send specially crafted HTTP GET requests containing absolute filesystem paths, bypassing directory restrictions.
Successful exploitation lets attackers retrieve arbitrary files from the host operating system, limited only by the privileges of the service process.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'The vulnerability can lead to the exposure of sensitive configuration files and system information on the affected system.'}, {'type': 'paragraph', 'content': 'This information disclosure increases the risk of further attacks by providing attackers with valuable reconnaissance data.'}, {'type': 'paragraph', 'content': "Because the attacker can access arbitrary files with the service's privileges, confidential data could be compromised."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP requests to the Navtor NavBox service for suspicious patterns, specifically crafted HTTP GET requests containing absolute filesystem paths.'}, {'type': 'paragraph', 'content': 'You can use network traffic analysis tools like tcpdump or Wireshark to capture HTTP traffic and look for requests with absolute paths.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture HTTP traffic on port 80: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'"}, {'type': 'list_item', 'content': "Use grep or similar tools on web server logs to search for requests containing absolute paths, e.g., grep -E 'GET /(/|[a-zA-Z]:\\\\)' access.log"}, {'type': 'paragraph', 'content': 'Additionally, checking for unexpected file access or unusual file read errors in system logs may help identify exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Navtor NavBox to version 4.16.2.4 or later, where the issue has been addressed.
Until the upgrade can be applied, restrict access to the NavBox HTTP service by implementing network-level controls such as firewall rules to limit access to trusted IP addresses only.
Monitor logs for suspicious requests and consider disabling or restricting the vulnerable HTTP service if possible.