CVE-2026-28427

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28427", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:54:05.137Z", "datePublished": "2026-03-04T19:30:07.137Z", "dateUpdated": "2026-03-04T21:05:38.200Z"}, "containers": {"cna": {"title": "OpenDeck affected by path traversal allows arbitrary file read", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-24", "lang": "en", "description": "CWE-24: Path Traversal: '../filedir'", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8"}, {"name": "https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed"}], "affected": [{"vendor": "nekename", "product": "OpenDeck", "versions": [{"version": "< 2.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T19:30:07.137Z"}, "descriptions": [{"lang": "en", "value": "OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does not properly sanitize path components. By including ../ sequences in the request path, an attacker can traverse outside the intended directory and read any file OpenDeck can access. This vulnerability is fixed in 2.8.1."}], "source": {"advisory": "GHSA-4974-g27q-h5m8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:05:01.866211Z", "id": "CVE-2026-28427", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:05:38.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28427", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T21:05:01.866211Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:05:25.327Z"}}], "cna": {"title": "OpenDeck affected by path traversal allows arbitrary file read", "source": {"advisory": "GHSA-4974-g27q-h5m8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nekename", "product": "OpenDeck", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "references": [{"url": "https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8", "name": "https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed", "name": "https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does not properly sanitize path components. By including ../ sequences in the request path, an attacker can traverse outside the intended directory and read any file OpenDeck can access. This vulnerability is fixed in 2.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-24", "description": "CWE-24: Path Traversal: '../filedir'"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T19:30:07.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28427", "state": "PUBLISHED", "dateUpdated": "2026-03-04T21:05:38.200Z", "dateReserved": "2026-02-27T15:54:05.137Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T19:30:07.137Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenDeck", "vendor": "nekename", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nekename:opendeck:*:*:*:*:*:*:*:*", "matchCriteriaId": "53910A23-CD21-49BA-8829-B691C5C1719C", "versionEndExcluding": "2.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does not properly sanitize path components. By including ../ sequences in the request path, an attacker can traverse outside the intended directory and read any file OpenDeck can access. This vulnerability is fixed in 2.8.1."}, {"lang": "es", "value": "OpenDeck es un software de Linux para tu Elgato Stream Deck. Antes de la 2.8.1, el servicio que escucha en el puerto 57118 sirve archivos est\u00e1ticos para los plugins instalados, pero no sanea correctamente los componentes de la ruta. Al incluir secuencias ../ en la ruta de la solicitud, un atacante puede atravesar fuera del directorio previsto y leer cualquier archivo al que OpenDeck pueda acceder. Esta vulnerabilidad se corrige en la versi\u00f3n 2.8.1."}], "id": "CVE-2026-28427", "lastModified": "2026-06-17T10:28:36.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28427", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:05:01.866211Z", "version": "2.0.3"}}]}, "published": "2026-03-04T20:16:19.640", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-24"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OpenDeck", "source": "cna", "vendor": "nekename"}, "product": "opendeck", "vendor": "nekename"}], "analysis": {"en": {"generated_at": "2026-04-16T13:08:39.474740+00:00", "value": {"mitigation_remediation": ["Upgrade OpenDeck to version 2.8.1 or later to apply the fix that sanitizes path components. ", "Restrict external access to port 57118 using firewall rules or network segmentation to only allow trusted hosts if a patch cannot be applied immediately. ", "Disable or remove unneeded plugins or directories that expose sensitive files to reduce the attack surface while the service remains vulnerable."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file read via path traversal"}, "threat_synthesis": {"affected_systems": "All installations of OpenDeck earlier than version 2.8.1 are affected, regardless of deployment environment. The vulnerability exists in the service that serves static files for installed plugins, and the affected product is the OpenDeck application from vendor nekename.", "description_and_impact": "OpenDeck, software for Elgato Stream Deck, allows attackers to read arbitrary files due to an uncensored path traversal in the static file service that listens on port 57118. By including '../' sequences in the request path, a malicious client can traverse outside the intended plugin directory and access any file that the OpenDeck process can read. This introduces a confidentiality breach, enabling disclosure of sensitive data such as configuration files, logs, or other local files.", "risk_and_exploitability": "The vulnerability carries a CVSS v3 score of 5.9, indicating moderate risk. The EPSS score is below 1%, suggesting low exploitation likelihood. It is not listed in the CISA Known Exploited Vulnerabilities catalogue. Based on the description, it is inferred that a remote attacker can send a specially crafted HTTP request to the service listening on port 57118, taking advantage of the improper sanitization of path components to traverse directories and read any file accessible to the OpenDeck process."}}}}, "created": "2026-03-05T09:05:48.792730+00:00", "updated": "2026-04-16T13:15:06.225946+00:00", "vendors": ["nekename", "nekename$PRODUCT$opendeck"]}