CVE-2026-67449

Name of the Vulnerable Software and Affected Versions Portabase versions prior to 1.21.2

Description A path traversal issue exists in the TUS upload webhook handler at the endpoint "app/api/tus/hooks/route.ts". This allows an unauthenticated remote attacker to overwrite arbitrary files within the private data directory, including the AES-256-GCM master key located at /data/private/keys/master key.bin. Path traversal is a vulnerability that allows an attacker to access or manipulate files and directories outside the intended folder by using special characters like dot-dot-slash (../).

Recommendations Update to version 1.21.2 or later.