{"id":"CVE-2026-107092","kind":"vulnerability","aliases":["CVE-2026-107092"],"related":[],"title":"NexoPOS: directory traversal in the api/update endpoint","description":"NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.","summary":"NexoPOS v6.2.4 is a point-of-sale web application whose api/update endpoint does not properly restrict file paths, allowing directory traversal. An attacker may be able to read or write files outside the intended directory, but the sources do not say which.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nexopos","other","php","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed NexoPOS version and see whether it is `6.2.4`.\n- unknown whether the sources give a specific file or setting to inspect.","fix":"- unknown: the sources do not name a fixed version or a workaround.\n- Until a fix is confirmed, restrict access to the api/update endpoint at the web server or firewall.","status":"open","published_at":"2026-10-26T14:16:23+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:55+00:00","updated_at":"2026-10-26T14:32:55+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-26T14:32:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or a workaround.\n- Until a fix is confirmed, restrict access to the api/update endpoint at the web server or firewall.","reach":"unknown","title":"NexoPOS: directory traversal in the api/update endpoint","impact":"medium","summary":"NexoPOS v6.2.4 is a point-of-sale web application whose api/update endpoint does not properly restrict file paths, allowing directory traversal. An attacker may be able to read or write files outside the intended directory, but the sources do not say which.","category":"other","nicknames":[],"who_cares":["nexopos","self-hosted","php"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not say what files are reachable","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107092 and the NexoPOS project for a fixed version, whether authentication is required, and what files are reachable.","how_to_check":"- Check the installed NexoPOS version and see whether it is `6.2.4`.\n- unknown whether the sources give a specific file or setting to inspect.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that self-host NexoPOS v6.2.4 and expose its api/update endpoint to users or networks they do not fully trust. The sources do not say whether the endpoint requires authentication or which configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3245,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107092':10A,13A '-2026':9A,12A 'abl':46B 'allow':39B 'api/update':6A,31B,71C 'applic':29B 'attack':43B 'cve':8A,11A 'directori':2A,40B,55B,67C 'endpoint':7A,32B,72C 'file':37B,51B 'host':19B 'intend':54B 'may':44B 'nexopo':1A,14B,20B,62C 'outsid':52B 'path':38B 'php':16B 'point':25B 'point-of-sal':24B 'proper':35B 'read':48B 'restrict':36B 'sale':27B 'say':61B 'self':18B 'self-host':17B 'sourc':58B 'travers':3A,41B,68C 'v6.2.4':21B,63C 'via':69C 'vulner':65C 'web':28B 'whose':30B 'write':50B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NexoPOS v6.2.4 and expose its api/update endpoint to users or networks they do not fully trust. The sources do not say whether the endpoint requires authentication or which configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107092","severity":null,"published_at":"2026-10-26T14:16:23+00:00","modified_at":"2026-10-26T14:16:23+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}