CVE-2026-63162

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description A path traversal flaw exists that allows attackers to write arbitrary files outside the intended temporary directory. This occurs when an unanchored tmpFolderName value is supplied in the upload destination path. By using a traversal sequence targeting the web root via the tmpFolderName variable, an attacker can write controlled files to the system and achieve remote code execution.

Recommendations Update Omnispace Agora Project to version 26.10.0 or later. Restrict the use of the tmpFolderName variable in upload paths to prevent directory traversal.