CVE-2026-77139

Name of the Vulnerable Software and Affected Versions Mask extension (affected versions not specified)

Description An authenticated backend user with access to the Mask module can perform path traversal, a technique used to access files and directories that are restricted from the user. The extension fails to validate a client-supplied template element key used to build file paths for saving and deleting Mask template files. By supplying a key containing path traversal sequences, an attacker can create or delete .html files outside the configured template directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.