CVE-2026-7185
Deferred Deferred - Pending Action

Path Traversal Vulnerability in TAO 2.0 Suite

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A validation vulnerability has been identified in certain web features related to file management or upload in several products of the TAO 2.0 suite. This vulnerability could allow an attacker capable of interacting with the affected feature to attempt to access file system resources outside the scope intended by the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-28
AI Q&A
2026-07-06
EPSS Evaluated
2026-07-26
NVD
CVE-2026-7185
EUVD
EUVD-2026-41874

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
tao archivo to 2602.00 (exc)
tao mytao to 2602.00 (exc)
tao estima to 2602.00 (exc)
tao buroweb to 2602.00 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7185 is a medium-severity validation vulnerability found in certain web features related to file management or upload in several products of the TAO 2.0 suite, including Archivo, MyTAO, eStima, and Buroweb. This flaw allows an attacker who can interact with the affected feature to attempt to access file system resources outside the intended scope of the application.

Detection Guidance

This vulnerability affects web features related to file management or upload in TAO 2.0 suite products prior to version 2602.00. Detection involves verifying the version of the affected products (Archivo, MyTAO, eStima, Buroweb) to ensure they are updated to 2602.0.0 or later.

Since the vulnerability allows unauthorized access to file system resources via web interactions, monitoring web requests for unusual file access patterns or attempts to access files outside the intended scope could help detect exploitation attempts.

Specific commands are not provided in the available resources. However, general detection steps include:

  • Check the version of the TAO 2.0 suite products installed on your system.
  • Review web server logs for suspicious file access or upload requests.
  • Use network monitoring tools to detect unusual HTTP requests targeting file management or upload endpoints.

To mitigate the vulnerability, update the affected products to version 2602.0.0 or later.

Impact Analysis

This vulnerability could allow an attacker to access files or resources on the system that should be restricted, potentially exposing sensitive data or system files. Exploitation does not require authentication but does require user interaction, which means an attacker could trick a user into triggering the vulnerability. This unauthorized access could lead to data breaches or compromise of system integrity.

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate CVE-2026-7185, users should update all affected TAO 2.0 suite products, including Archivo, MyTAO, eStima, and Buroweb, to version 2602.0.0 or later.

This update fixes the validation vulnerability in web features related to file management or upload that could allow unauthorized access to file system resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart