CVE-2026-50186

Received Received - Intake

Path Traversal in 4gaBoards System

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is passed to path.join() beneath private/exports/<user_id>/ without containment validation. A crafted value such as ../ can select an arbitrary file readable by the server process, and the file is returned to the attacker. The fileStream close handler then passes the same path to fs.unlink(), deleting the selected file and potentially causing data loss or denial of service. This issue is fixed in version 3.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-50186

Affected Vendors & Products

Vendor	Product	Version / Range
4gaboards	4gaboards	to 3.3.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in 4gaBoards versions prior to 3.3.8. An authenticated project manager can manipulate the filename parameter in a GET request to access or delete arbitrary files on the server. The flaw occurs because user input is passed directly to path.join() without proper validation, allowing sequences like ../ to traverse directories.

Detection Guidance

Check if your 4gaBoards instance is running a version prior to 3.3.8. Review server logs for suspicious GET requests to /exports/:id/:filename with path traversal sequences like ../ in the filename parameter. Test by attempting to access arbitrary files via crafted requests.

Impact Analysis

An attacker could read sensitive files on the server, such as configuration files or other users' data. They could also delete critical files, leading to data loss or denial of service. The impact requires authentication but could be severe if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it risks exposing protected health information. Compliance failures may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade 4gaBoards to version 3.3.8 or later immediately. If upgrading is not possible, restrict access to the /exports endpoint and monitor for unusual file access or deletion attempts. Ensure backups of critical files are available.

Hi! I’m here to help you understand CVE-2026-50186. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70