CVE-2026-67395

Name of the Vulnerable Software and Affected Versions Sage Employee Self Service (affected versions not specified)

Description Improper validation of file path parameters in the custom logo functionality allows for path traversal. An attacker can use directory traversal sequences and encoded variants to bypass restrictions and access files outside the intended file system scope. This could lead to the disclosure of sensitive information, such as configuration files, environment settings, application assets, and log data, provided the attacker knows valid file names and paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.