Path traversal in MarkLogic - CVE-2026-85953
Published: October 12, 2026
Vulnerability identifier: #VU154126
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85953
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access server files without authorization or execute operations under an unintended identity.
The vulnerability exists due to path traversal and improper privilege management in privileged legacy InfoStudio modules when processing user-controlled file paths and user-context values. A remote user can supply unsafe file paths or user-context values to access server files without authorization or execute operations under an unintended identity.
Affected software
MarkLogic
How to mitigate CVE-2026-85953
Install security update from vendor's website.
MarkLogic - addressed in versions 11.3.7, 12.1