PT-2026-96706
CVE-2026-63278
·
تاريخ النشر
2026-09-22
·
تاريخ التحديث
2026-10-17
الوصف من
CVSS 4.0
6.7
متوسطةالمقاييسAV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a document containing such links is opened. This occurs because the check for the package content provider does not recognize all naming variations, allowing certain URLs to bypass the check and trigger the expansion.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾