Dashboard / CVE-2026-11944

CVE-2026-11944

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 61/100
Published: 2026-07-14 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
os4ed opensis 9.3

References & Advisories (2)

https://fluidattacks.com/es/advisories/toto
Third Party Advisory Exploit

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.48%
Raw Score 0.004810
Percentile 41.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00481
2026-10-28
0.00481

Intelligence Sources

nvd ref →

External Links