CVE-2026-108810
Received Received - Intake

Path Traversal in tsi-dpdp-cms

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108810
EUVD
EUVD-2026-97283

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tsi-coop tsi-dpdp-cms 0.5.0
tsi-coop tsi-dpdp-cms 0.5.1
tsi-coop tsi-dpdp-cms 0.5.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108810 is an information disclosure vulnerability in the TSI-DPDP-CMS software versions 0.5.0 to 0.5.2. The issue occurs because the system validates JSON request schemas before checking authentication. Unauthenticated attackers can exploit this by sending requests with valid function names but missing required fields, causing the server to return detailed error messages that reveal internal API parameter schemas, including sensitive field names like 'fiduciary_id'.

Detection Guidance

To detect this vulnerability, check if your TSI-DPDP-CMS instance is running versions 0.5.0, 0.5.1, or 0.5.2. Test unauthenticated API endpoints by sending POST requests with valid '_func' values but missing required fields. If the server returns detailed 400 error messages revealing parameter schemas, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to map out the internal API structure without credentials, exposing details about admin and DPO APIs. While it doesn't grant direct access to data, it enables more efficient targeted attacks like SQL injection by revealing the data model. The impact is limited to information exposure but could facilitate further exploits.

Compliance Impact

This vulnerability exposes internal API parameter schemas, including sensitive field names like 'fiduciary_id' and admin/DPO API details, without authentication. Such information disclosure could violate GDPR's data minimization and security principles by revealing system structures that attackers might exploit. For HIPAA, it risks compromising protected health information systems by exposing API schemas used in consent management.

Mitigation Strategies

Upgrade TSI-DPDP-CMS to version 0.5.3 or later immediately. This version reorders authentication and validation processes to prevent schema exposure. Verify the fix by testing unauthenticated requests again to ensure they return generic 401 errors without schema details.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart