CVE-2026-49009

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal...

CVE-2026-49009

Mender Server (v4.1.0, v4.0.1, and below) is vulnerable to an authenticated path traversal in the single-file artifact generation API endpoint. The root cause is a failure to sanitize the args.filename field, allowing an authenticated attacker to escape the intended upload directory. By using ../...