CVE-2026-104763

Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.2

Description An issue exists where authenticated attackers with administrator-level access and above can read arbitrary files on the server. This is achieved by uploading a crafted ZIP archive containing a media metadata.json file with path traversal sequences in the file path parameter. By specifying an allowed file extension for the destination filename, the attacker can bypass the extension guard implemented in version 1.13.2. Directory Traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update Post Export Import with Media to version 1.17.2 or later.