---
id: "CVE-2026-107092"
kind: "vulnerability"
aliases: ["CVE-2026-107092"]
title: "NexoPOS: directory traversal in the api/update endpoint"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["nexopos", "other", "php", "self-hosted"]
not_affected_if: []
published_at: "2026-10-26T14:16:23+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107092", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# NexoPOS: directory traversal in the api/update endpoint

NexoPOS v6.2.4 is a point-of-sale web application whose api/update endpoint does not properly restrict file paths, allowing directory traversal. An attacker may be able to read or write files outside the intended directory, but the sources do not say which.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NexoPOS version and see whether it is `6.2.4`.
- unknown whether the sources give a specific file or setting to inspect.

## Fix

- unknown: the sources do not name a fixed version or a workaround.
- Until a fix is confirmed, restrict access to the api/update endpoint at the web server or firewall.

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107092

## From the sources

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_