CVE-2026-32820

Name of the Vulnerable Software and Affected Versions dataCycle-CORE versions prior to 26.06.08

Description The documentation and static markdown renderer in the core processing and framework rules module accepts attacker-controlled path segments. Because these segments are only processed by the Rails HTML sanitizer, which fails to remove directory traversal sequences, an unauthenticated attacker can access and render arbitrary .md files from the application root or engine root by traversing outside the intended docs or static directories.

Recommendations Update dataCycle-CORE to version 26.06.08.