CVE-2026-36723

The car rental management platform Bookcars v8.3 contains an unrestricted file rename vulnerability within the /api/create-user component. This flaw allows authenticated attackers to use directory traversal sequences to move arbitrary files from temporary storage to any location on the server fil...