CVE-2026-36723

Name of the Vulnerable Software and Affected Versions bookcars version 8.3

Description An unrestricted file rename issue exists in the '/api/create-user' endpoint. Authenticated attackers can use directory traversal sequences—a method used to access files and directories outside the intended folder—to move arbitrary files from temporary storage to any location on the server filesystem. This can lead to unauthorized access to sensitive data, the overwriting of critical application files, and remote code execution (RCE).

Recommendations Update bookcars version 8.3 to a patched version. Restrict access to the '/api/create-user' endpoint to minimize the risk of exploitation.