CVE-2026-62278

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8

Description Authenticated non-administrative users can access the HandleTranslationFileUpload endpoint and influence the filename passed from Controllers/FilesController.cs to the RenameFile() function in Helper/FileHelper.cs. The RenameFile() function constructs a newFilePath using string replacement and moves the uploaded file without verifying if the resolved absolute path remains within the web root or data directory. This allows an attacker to use a crafted upload name to move a file outside the intended storage directory, leading to unauthorized file placement or overwriting files with the privileges of the application process.

Recommendations Update LubeLogger to version 1.6.8.