Vulnerability Details CVE-2026-49488
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.
This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0.
An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-49488
-
cpe:2.3:a:apache:openmeetings:5.0.0
-
cpe:2.3:a:apache:openmeetings:5.0.1
-
cpe:2.3:a:apache:openmeetings:6.0.0
-
cpe:2.3:a:apache:openmeetings:6.1.0
-
cpe:2.3:a:apache:openmeetings:6.2.0
-
cpe:2.3:a:apache:openmeetings:6.3.0
-
cpe:2.3:a:apache:openmeetings:7.0.0
-
cpe:2.3:a:apache:openmeetings:8.0.0