Vulnerability Details CVE-2026-49488
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.
This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0.
An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 42.4%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-49488
-
cpe:2.3:a:apache:openmeetings:5.0.0
-
cpe:2.3:a:apache:openmeetings:5.0.1
-
cpe:2.3:a:apache:openmeetings:6.0.0
-
cpe:2.3:a:apache:openmeetings:6.1.0
-
cpe:2.3:a:apache:openmeetings:6.2.0
-
cpe:2.3:a:apache:openmeetings:6.3.0
-
cpe:2.3:a:apache:openmeetings:7.0.0
-
cpe:2.3:a:apache:openmeetings:8.0.0