PT-2026-96706
CVE-2026-63278
·
Published
2026-09-22
·
Updated
2026-10-17
Description by
CVSS 4.0
6.7
MediumMetricsAV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a document containing such links is opened. This occurs because the check for the package content provider does not recognize all naming variations, allowing certain URLs to bypass the check and trigger the expansion.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾