CVE-2026-50186

creationtimestamp| type| source ---|---|--- 2026-08-19 00:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtfgg7nie72z 2026-08-20 03:00:03+00:00| published-proof-of-concept| Telegram/TXByhyAHALLjU76evu5RVvsn4zpzLoBf6fuRONOvcY2o 2026-08-21 00:00:11+00:00|...

CVE-2026-50186

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

CVE-2026-50186

An authenticated project manager in 4gaBoards