CVE-2026-50186

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8

Description An authenticated project manager can use traversal sequences in the filename parameter of the 'GET /exports/:id/:filename' endpoint. In the server/api/controllers/boards/download.js file, the inputs.filename value is processed by path.join() without proper containment validation. This allows an attacker to use sequences like ../ to read arbitrary files accessible by the server process. Additionally, the fileStream close handler uses the same path in the fs.unlink() function, which deletes the accessed file, potentially leading to data loss or denial of service.

Recommendations Update to version 3.3.8. Avoid using the filename parameter in the 'GET /exports/:id/:filename' endpoint until the update is applied.