Live › vulnerability › CVE-2026-111635
Go to dashboardHelical Insight through 7.0.0 fails to restrict the path parameter of /getExternalResource, so parent-directory segments escape the solution directory. An authenticated viewer can read any readable file with an allowed extension such as js, json or html, bypassing per-resource access control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Helical Insight 7.0.0 or earlier where viewer accounts exist. The sources describe the flaw as reachable only after login, so deployments with no viewer accounts are less exposed. The sources do not say which fixed version to move to.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.
This page as .md · .json · in your agent: get_signal("CVE-2026-111635")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.