CVE-2026-116067

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and...

CVE-2026-116067

Paisa versions prior to 0.7.8 are vulnerable to a path traversal vulnerability within the GetFile , GetSheet , DeleteBackups , and DeleteSheetBackups handlers. The root cause is the improper sanitization of ../ sequences in filenames, which allows unauthenticated attackers to read arbitrary serve...

CVE-2026-116067 Paisa before 0.7.8 Path Traversal via Editor and Sheet API

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and...

EUVD-2026-109381

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and...