Live › vulnerability › CVE-2026-107092
Go to dashboardNexoPOS v6.2.4 is a point-of-sale web application whose api/update endpoint does not properly restrict file paths, allowing directory traversal. An attacker may be able to read or write files outside the intended directory, but the sources do not say which.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams that self-host NexoPOS v6.2.4 and expose its api/update endpoint to users or networks they do not fully trust. The sources do not say whether the endpoint requires authentication or which configurations are affected.
No product ranges from the sources yet.
6.2.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-107092")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.