Live › vulnerability › CVE-2026-116067
Go to dashboardPaisa, a personal finance app, has a path traversal flaw in its file and backup handlers before 0.7.8. An unauthenticated attacker can send names containing ../ to read any file the server can read and delete backup files outside the journal or sheets directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Teams that run Paisa on a server reachable by others, especially on the internet, are exposed. Local single-user installs that are not reachable from the network are at much lower risk. The sources do not say whether default installs bind to all interfaces.
No product ranges from the sources yet.
0.7.8.0.7.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116067")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.