Absolute Path Traversal in Navtor NavBox Allows File Disclosure

Executive Summary

CVE-2026-2753 is an absolute path traversal vulnerability in Navtor NavBox version 4.12.0.3. It occurs because the application exposes an HTTP service that does not properly sanitize user-supplied path input.

This flaw allows unauthenticated remote attackers to send specially crafted HTTP GET requests containing absolute filesystem paths, bypassing directory restrictions.

Successful exploitation lets attackers retrieve arbitrary files from the host operating system, limited only by the privileges of the service process.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'The vulnerability can lead to the exposure of sensitive configuration files and system information on the affected system.'}, {'type': 'paragraph', 'content': 'This information disclosure increases the risk of further attacks by providing attackers with valuable reconnaissance data.'}, {'type': 'paragraph', 'content': "Because the attacker can access arbitrary files with the service's privileges, confidential data could be compromised."}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP requests to the Navtor NavBox service for suspicious patterns, specifically crafted HTTP GET requests containing absolute filesystem paths.'}, {'type': 'paragraph', 'content': 'You can use network traffic analysis tools like tcpdump or Wireshark to capture HTTP traffic and look for requests with absolute paths.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture HTTP traffic on port 80: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'"}, {'type': 'list_item', 'content': "Use grep or similar tools on web server logs to search for requests containing absolute paths, e.g., grep -E 'GET /(/|[a-zA-Z]:\\\\)' access.log"}, {'type': 'paragraph', 'content': 'Additionally, checking for unexpected file access or unusual file read errors in system logs may help identify exploitation attempts.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Navtor NavBox to version 4.16.2.4 or later, where the issue has been addressed.

Until the upgrade can be applied, restrict access to the NavBox HTTP service by implementing network-level controls such as firewall rules to limit access to trusted IP addresses only.

Monitor logs for suspicious requests and consider disabling or restricting the vulnerable HTTP service if possible.

Useful 0 Not Useful 0