CVE-2026-5114

Name of the Vulnerable Software and Affected Versions SpeedyCache versions prior to 1.3.9

Description An Arbitrary File Read issue exists due to Path Traversal, which occurs when a mismatch between CSS URL validation and path resolution allows query strings to bypass checks. Because the system does not verify if the resolved file is actually a CSS file, authenticated attackers with Administrator-level access can inject crafted <link> tags into page content. This process allows the reading of sensitive server files, such as wp-config.php and /etc/passwd, by writing their contents into publicly accessible cache files.

Recommendations Update SpeedyCache to version 1.3.9 or later.