{"id":"CVE-2026-116255","kind":"vulnerability","aliases":["CVE-2026-116255"],"related":[],"title":"CodeFever: path traversal in document controller lets remote users read files","description":"A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is e4433eee96883a222403854e8ac38b3146774a07. Applying a patch is the recommended action to fix this issue.","summary":"CodeFever, a PHP project management tool, has a path traversal flaw in the _detail function of application/controllers/doc.php where the uri_string argument is not sanitized. A remote attacker can use it to reach files outside the intended directory on the server.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["codefever","package","php","self-hosted"],"not_affected_if":["managed-hosting","patched-commit"],"how_to_check":"- Check whether the deployed CodeFever checkout includes commit `e4433eee96883a222403854e8ac38b3146774a07` (for example `git branch --contains e4433eee96883a222403854e8ac38b3146774a07` in the install directory)\n- Look at application/controllers/doc.php in the install and see whether the _detail function still passes uri_string through without sanitizing\n- unknown for versions: the product uses a rolling release model and the sources give no affected version numbers","fix":"- Apply patch commit `e4433eee96883a222403854e8ac38b3146774a07` to the CodeFever install, or update to a release that contains it\n- unknown for a specific version number: the sources state no fixed release\n- Restrict the web server's access to files outside the application directory until patched","status":"open","published_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:56+00:00","updated_at":"2026-10-26T10:30:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T10:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apply patch commit `e4433eee96883a222403854e8ac38b3146774a07` to the CodeFever install, or update to a release that contains it\n- unknown for a specific version number: the sources state no fixed release\n- Restrict the web server's access to files outside the application directory until patched","reach":"internet","title":"CodeFever: path traversal in document controller lets remote users read files","impact":"medium","summary":"CodeFever, a PHP project management tool, has a path traversal flaw in the _detail function of application/controllers/doc.php where the uri_string argument is not sanitized. A remote attacker can use it to reach files outside the intended directory on the server.","category":"package","nicknames":[],"who_cares":["codefever","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads arbitrary server files readable by the web process","analyst_note":"Confirm whether the doc controller path traversal needs a logged-in session and whether the affected code path is reachable by default, using the NVD entry and the upstream commit e4433eee96883a222403854e8ac38b3146774a07.","how_to_check":"- Check whether the deployed CodeFever checkout includes commit `e4433eee96883a222403854e8ac38b3146774a07` (for example `git branch --contains e4433eee96883a222403854e8ac38b3146774a07` in the install directory)\n- Look at application/controllers/doc.php in the install and see whether the _detail function still passes uri_string through without sanitizing\n- unknown for versions: the product uses a rolling release model and the sources give no affected version numbers","needs_analyst":true,"not_affected_if":["managed-hosting","patched-commit"],"who_is_affected":"Teams that run a self-hosted CodeFever instance that is reachable from the network and has not applied the patch dated after commit 0c35e60f006f9d558cc33a159baf110659351990. Teams that use only a hosted instance managed by someone else, or that do not run CodeFever at all, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":3441,"output_tokens":735,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116255':14A,17A '-2026':13A,16A '0c35e60f006f9d558cc33a159baf110659351990':75C 'action':157C 'affect':76C,137C 'appli':151C 'application/controllers/doc.php':40B,84C 'argument':45B,94C 'attack':51B,102C 'avail':143C 'codefev':1A,18B,24B,72C 'compon':87C 'continu':128C 'control':6A 'cve':12A,15A 'deliv':127C 'detail':37B,80C 'directori':61B 'disclos':111C 'document':5A 'e4433eee96883a222403854e8ac38b3146774a07':150C 'exploit':108C 'file':11A,57B,83C 'fix':159C 'flaw':34B 'found':69C 'function':38B,79C 'host':23B 'identifi':145C 'inform':135C 'initi':105C 'intend':60B 'issu':161C 'lead':97C 'let':7A 'manag':28B 'manipul':91C 'may':103C,116C 'model':125C 'outsid':58B 'packag':19B 'patch':148C,153C 'path':2A,32B,99C 'pgyer':71C 'php':20B,26B 'product':120C 'project':27B 'public':114C 'reach':56B 'read':10A 'recommend':156C 'releas':124C,140C 'remot':8A,50B,106C 'result':132C 'roll':123C 'sanit':48B,89C 'self':22B 'self-host':21B 'server':64B 'specif':133C 'string':44B,96C 'tool':29B 'travers':3A,33B,100C 'updat':129C,139C 'uri':43B,88C,95C 'use':53B,118C,121C 'user':9A 'version':134C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted CodeFever instance that is reachable from the network and has not applied the patch dated after commit 0c35e60f006f9d558cc33a159baf110659351990. Teams that use only a hosted instance managed by someone else, or that do not run CodeFever at all, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116255","severity":null,"published_at":"2026-10-26T10:16:53+00:00","modified_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}