CVE-2026-40526

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System (affected versions not specified)

Description Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/{path}' endpoint. This occurs because the path route parameter is passed directly to the file get contents() function without canonicalization, which is the process of converting a path to its simplest, standard form to prevent bypassing security checks. This allows the retrieval of sensitive files accessible to the PHP-FPM worker process without requiring directory traversal sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the path parameter in the 'GET /public/get-file/{path}' endpoint until the issue is resolved.