CVE-2026-15932

Name of the Vulnerable Software and Affected Versions Support Genix versions prior to 1.4.48

Description An issue exists in the ticket-attachment download route that fails to prevent directory traversal. This allows unauthenticated attackers to read arbitrary files from the server that possess an allowlisted extension, which may include private ticket attachments belonging to other users. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update Support Genix to version 1.4.48 or later.