CVE-2026-76806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76806", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-19T19:52:28.212Z", "datePublished": "2026-11-04T19:31:54.604Z", "dateUpdated": "2026-11-09T17:00:09.078Z"}, "containers": {"cna": {"title": "Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"}, {"name": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be"}, {"name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0"}], "affected": [{"vendor": "solidtime-io", "product": "solidtime", "versions": [{"version": "< 0.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T19:31:54.604Z"}, "descriptions": [{"lang": "en", "value": "Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."}], "source": {"advisory": "GHSA-cj49-589g-wp6j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:09:13.747209Z", "id": "CVE-2026-76806", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:00:09.078Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76806", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:09:13.747209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:09:14.968Z"}}], "cna": {"title": "Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle", "source": {"advisory": "GHSA-cj49-589g-wp6j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "solidtime-io", "product": "solidtime", "versions": [{"status": "affected", "version": "< 0.16.0"}]}], "references": [{"url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j", "name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be", "name": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0", "name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T19:31:54.604Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76806", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:00:09.078Z", "dateReserved": "2026-08-19T19:52:28.212Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T19:31:54.604Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "solidtime", "vendor": "solidtime-io", "versions": [{"status": "affected", "version": "< 0.16.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."}], "id": "CVE-2026-76806", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76806", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:09:13.747209Z", "version": "2.0.3"}}]}, "published": "2026-11-04T20:19:12.810", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be"}, {"source": "security-advisories@github.com", "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "solidtime: solidtime: Arbitrary directory creation via path traversal in Toggl importer", "id": "2567853", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567853"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.", "A flaw was found in solidtime. An authenticated remote attacker can exploit this vulnerability by uploading a specially crafted archive file containing directory traversal sequences during a Toggl data import. Successful exploitation allows the attacker to bypass directory restrictions, create directories in arbitrary writable host locations, and infer the existence of host files from application responses."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-76806", "public_date": "2026-11-04T19:31:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76806\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76806\nhttps://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be\nhttps://github.com/solidtime-io/solidtime/releases/tag/v0.16.0\nhttps://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires authenticated access to the Toggl import interface and the impact is limited to creating empty directories and probing file existence, rather than arbitrary file modification or remote code execution. Solidtime is not packaged or distributed in Red Hat enterprise offerings, and default environments do not expose this software. Consequently, the flaw presents no direct operational impact on supported Red Hat products.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "solidtime", "source": "cna", "vendor": "solidtime-io"}, "product": "solidtime", "vendor": "solidtime-io"}], "created": "2026-11-04T20:45:07.036753+00:00", "updated": "2026-11-04T21:15:14.533542+00:00", "vendors": ["solidtime-io", "solidtime-io$PRODUCT$solidtime"]}