Authenticated Path Traversal in openSIS Classic 9.3

Executive Summary

CVE-2026-11944 is an authenticated path traversal vulnerability in openSIS Classic version 9.3. It affects the legacy messaging sent-mail attachment download functionality.

An authenticated attacker with access to the Messaging module can exploit this vulnerability by sending a crafted POST request to the AJAX module loader for messaging/SentMail.php. The vulnerability occurs because the code only replaces backslashes in the attacker-controlled filename parameter, leaving Unix-style path traversal sequences like ../ intact.

This allows the attacker to read arbitrary files on the server that are readable by the web server process. The issue exists due to insufficient input validation and path normalization in the SentMail.php module.

• Exploitation requires a valid low-privileged user account with Messaging access.
• No patch is currently available for this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-11944 vulnerability in openSIS Classic 9.3, you can check for the presence of the vulnerable SentMail attachment download functionality and test for path traversal exploitation.

• Verify the openSIS Classic version: Ensure the system is running version 9.3, as this is the affected version.
• Check for the vulnerable endpoint: The vulnerability exists in the messaging/SentMail.php module. You can inspect the web server logs for requests to this endpoint or use a web application scanner to identify its presence.
• Test for path traversal: Using a low-privileged authenticated account with Messaging module access, send a crafted POST request to the AJAX module loader for messaging/SentMail.php with a filename parameter containing path traversal sequences (e.g., ../../../../etc/passwd). If the server returns the contents of the requested file, the system is vulnerable.
• Example command to test for the vulnerability (using curl):
• curl -X POST -d "modname=messaging/SentMail.php&modfunc=download_attachment&filename=../../../../etc/passwd" -H "Cookie: [your_auth_cookie]" http://[your_opensis_server]/modules/messaging/messaging_ajax.php

If the response contains the contents of /etc/passwd or another sensitive file, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using openSIS Classic 9.3.

• An attacker with a valid low-privileged account can read arbitrary files on the server, including sensitive data such as configuration files, system files, or database credentials.
• Exposure of sensitive data can lead to further attacks, such as unauthorized access to the database or other critical systems.
• If the server contains personally identifiable information (PII) or other regulated data, its exposure could result in data breaches.
• The vulnerability could be used to escalate privileges or move laterally within the network if the exposed files contain credentials or other sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the exposed files contain personal data of EU citizens, unauthorized access to this data could constitute a data breach under GDPR. This may lead to significant fines and legal consequences for failing to protect personal data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the openSIS system stores or processes protected health information (PHI), unauthorized access to this data due to the vulnerability could result in a HIPAA violation. This could lead to penalties, legal action, and loss of trust from patients and partners.
• Other regulations: Depending on the industry and type of data stored, this vulnerability could also impact compliance with standards like FERPA (for educational records), PCI DSS (for payment card data), or other sector-specific regulations. Non-compliance may result in fines, legal repercussions, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Since there is currently no patch available for CVE-2026-11944, you can take the following immediate steps to mitigate the risk:

• Restrict access to the Messaging module: Limit access to the Messaging module to only trusted users who require it for their roles. This reduces the attack surface.
• Disable the SentMail attachment download functionality: Temporarily disable the vulnerable feature by removing or renaming the messaging/SentMail.php file or restricting access to it via web server configuration (e.g., Apache .htaccess or Nginx rules).
• Implement input validation: If possible, modify the SentMail.php module to properly sanitize the filename parameter by removing or blocking path traversal sequences (e.g., ../ or ..\).
• Monitor and log access: Enable detailed logging for requests to the messaging/SentMail.php endpoint to detect and investigate any suspicious activity.
• Apply network-level protections: Use a web application firewall (WAF) to block requests containing path traversal sequences targeting the vulnerable endpoint.
• Stay updated: Monitor the official openSIS Classic repository (Resource 1) and the Fluid Attacks advisory (Resource 2) for patches or updates addressing this vulnerability.

Useful 0 Not Useful 0