SB2026082563 - Path traversal in Apache OpenMeetings

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-49488)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in the download request handler when processing a crafted download request. A remote user can send a crafted download request to disclose sensitive information.

Exploitation requires moderator rights in any room, and exposed files are limited to those accessible to the operating system account running the server.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=gt3m3tbzh2o16hv8t373ko56k5fq544x
• https://issues.apache.org/jira/browse/OPENMEETINGS-2821