https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T04:24:20.238718+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-108688 CVE-2026-108688 — Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload 2026-10-16T04:24:20.239693+00:00

Affected: elunez eladmin

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.