CVE-2026-107092

Name of the Vulnerable Software and Affected Versions NexoPOS version 6.2.4

Description An issue exists in the point-of-sale system that allows remote users to read files on the server. This is achieved through a directory traversal flaw at the 'api/update' endpoint, where directory traversal is a method used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.