CVE-2026-40526: Improper Limitation of a Pathname to a Restricted Directory

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...