PT-2026-82554

CVE-2026-79653

Published

2026-08-27

Updated

2026-09-09

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Eclipse SW360 versions 19.0.0 through 20.1.0

Description When the system is configured to use file system storage via the enable.attachment.store.to.file.system config key, an attacker can manipulate the filename during upload. This allows for arbitrary file path traversal, a technique used to access files and directories that are stored outside the intended folder.

Recommendations Update to a fixed version. Disable the enable.attachment.store.to.file.system configuration key as a temporary workaround.

Exploitability

Exploit

Fix

Impacts

Researchers

Ezinne Kalu

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')