CVE-2026-6620

Summary: CVE-2026-6620 affects SonicCloudOrg sonic-server (≤ 2.0.0). The vulnerability is in the file upload endpoint’s Upload function (FileTool.java), where manipulation of the Type argument enables path traversal. This could be exploited remotely; an exploit is publicly available. The vendor h...

CVE-2026-6620: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component File Upload Endpoint. The manipulation of the argument Type results in path traversal. The attack may be launched remotely. The exploit has...