{"id":"CVE-2026-105457","kind":"vulnerability","aliases":["CVE-2026-105457"],"related":[],"title":"HAVELSAN Liman MYS: path traversal flaw in versions before 2.3.5-1132","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal.\n\nThis issue affects Liman MYS: before 2.3.5-1132.","summary":"HAVELSAN Liman MYS contains a path traversal flaw that lets input escape a restricted directory. The sources do not say what an attacker can read or write through it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["havelsan","liman-mys","other"],"not_affected_if":["version-2.3.5-1132-or-later"],"how_to_check":"- Check the installed Liman MYS version against `2.3.5-1132`; the sources give no other command or file to inspect.","fix":"- Upgrade Liman MYS to `2.3.5-1132` or later; the sources name no other workaround.","status":"open","published_at":"2026-10-28T10:17:07+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:30+00:00","updated_at":"2026-10-28T10:34:30+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-28T10:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Liman MYS to `2.3.5-1132` or later; the sources name no other workaround.","reach":"unknown","title":"HAVELSAN Liman MYS: path traversal flaw in versions before 2.3.5-1132","impact":"medium","summary":"HAVELSAN Liman MYS contains a path traversal flaw that lets input escape a restricted directory. The sources do not say what an attacker can read or write through it.","category":"other","nicknames":[],"who_cares":["liman-mys","havelsan"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; file access outside the restricted directory, extent not stated","analyst_note":"Check the NVD entry and HAVELSAN advisory for the vulnerable endpoint, required privileges and whether the flaw is remotely reachable.","how_to_check":"- Check the installed Liman MYS version against `2.3.5-1132`; the sources give no other command or file to inspect.","needs_analyst":true,"not_affected_if":["version-2.3.5-1132-or-later"],"who_is_affected":"Organizations running Liman MYS before version 2.3.5-1132. The sources do not describe the data path or configuration that makes a deployment exposed, so unknown beyond the version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000571,"input_tokens":3314,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105457':14A,17A '-1132':11A,76C '-2026':13A,16A '2.3.5':10A,75C 'affect':71C 'allow':66C 'attack':44B 'contain':25B 'cve':12A,15A 'directori':36B,57C 'escap':33B 'flaw':6A,29B 'havelsan':1A,18B,22B,62C 'improp':49C 'inc':63C 'input':32B 'issu':70C 'let':31B 'liman':2A,20B,23B,64C,72C 'liman-mi':19B 'limit':50C 'mys':3A,21B,24B,65C,73C 'path':4A,27B,58C,67C 'pathnam':53C 'read':46B 'restrict':35B,56C 'say':41B 'sourc':38B 'travers':5A,28B,59C,68C 'version':8A 'vulner':60C 'write':48B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Liman MYS before version 2.3.5-1132. The sources do not describe the data path or configuration that makes a deployment exposed, so unknown beyond the version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105457","severity":null,"published_at":"2026-10-28T10:17:07+00:00","modified_at":"2026-10-28T10:17:07+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}