CVE-2026-19054

Name of the Vulnerable Software and Affected Versions lspace-server versions up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71

Description An issue in the Repositories File API component within the file src/core/repository.ts allows for path traversal—a method used to access files and directories that are stored outside the intended folder. This occurs when the filePath argument is manipulated within the fileExists(), readFile(), writeFile(), and deleteFile() functions. Exploitation requires local access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.