CVE-2026-76806

Name of the Vulnerable Software and Affected Versions Solidtime versions prior to 0.16.0

Description An issue exists where the importData() function in TogglDataImporter processes project ID values from projects.json within uploaded ZIP imports without proper validation. By using traversal sequences, an attacker can escape the temporary sandbox and create directories at arbitrary writable host paths. Additionally, the ImportController provides distinguishable responses that reveal the existence of host paths derived from projects users/{id}.json or tasks/{id}.json. A registered user can trigger this behavior via the POST '/api/v1/organizations/{org}/import' endpoint by setting the type parameter to toggl data importer, potentially leading to directory exhaustion and disclosure of host layout information.

Recommendations Update to version 0.16.0.