CVE-2026-66491

Arbitrary File Read via getSource in PhocaCommander PhocaCommander ≤ 6.1.3 — Authenticated Admin Path Traversal, No CSRF Required SUMMARY An arbitrary file read vulnerability exists in PhocaCommander's file editor endpoint. The getSource function decodes a base64-encoded filename parameter and...