PT-2026-109673 · Genoffice · Genoffice
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
GenOffice versions prior to 0.11.506
Description
An incorrect permissions issue exists in the HTTP MCP server file store. Local unprivileged users can access the world-readable
genoffice-mcp-http directory located within the system temporary directory. This allows attackers to read uploaded client documents and converted outputs, effectively bypassing the HTTP bearer token authentication.Recommendations
Update GenOffice to version 0.11.506 or later.
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Genoffice