CVE-2026-7676

Name of the Vulnerable Software and Affected Versions kerwincui FastBee versions prior to 1.2.2

Description A path traversal issue exists in the Tool Download Endpoint. Remote attackers can manipulate the fileName argument within the download() function of the ToolController class to access files outside the intended directory.

Recommendations As a temporary workaround, restrict access to the download() function in the ToolController class to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.