{"id":"CVE-2026-125385","kind":"vulnerability","aliases":["CVE-2026-125385"],"related":[],"title":"INDOTALENT WHMS: path traversal lets signed-in users read server files","description":"INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.","summary":"INDOTALENT WHMS before 10.20261109 has a path traversal flaw in the documentName and imageName parameters of its GetDocument and GetImage handlers. An authenticated user, including one who self-registers, can read arbitrary files on the server such as appsettings.json, which can expose secrets.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["indotalent","other","self-hosted","whms"],"not_affected_if":["no-user-accounts","version-10.20261109-or-later"],"how_to_check":"- Check the installed WHMS version against `10.20261109`; anything earlier is in the affected range.\n- Confirm whether users can self-register, since the description says an attacker can create an account first.","fix":"- WHMS: upgrade to `10.20261109` or later (per the product range in the advisory data).","status":"open","published_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:13+00:00","updated_at":"2026-11-10T00:30:13+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T00:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- WHMS: upgrade to `10.20261109` or later (per the product range in the advisory data).","reach":"internet","title":"INDOTALENT WHMS: path traversal lets signed-in users read server files","impact":"medium","summary":"INDOTALENT WHMS before 10.20261109 has a path traversal flaw in the documentName and imageName parameters of its GetDocument and GetImage handlers. An authenticated user, including one who self-registers, can read arbitrary files on the server such as appsettings.json, which can expose secrets.","audience":"businesses","category":"other","nicknames":[],"who_cares":["whms","indotalent","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server configuration files and secrets readable by any logged-in user","analyst_note":"Confirm whether self-registration is on by default and whether the sources list any secret-exposure detail beyond appsettings.json; the patch links were not read.","how_to_check":"- Check the installed WHMS version against `10.20261109`; anything earlier is in the affected range.\n- Confirm whether users can self-register, since the description says an attacker can create an account first.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-10.20261109-or-later","no-user-accounts"],"who_is_affected":"Any WHMS deployment before `10.20261109` where users can log in, especially if self-registration is enabled. The flaw sits in the document and image retrieval endpoints, so exposure depends on those endpoints being reachable by authenticated users. Teams running the product should check their version first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4632,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125385':15A,18A '-2026':14A,17A '10.20261109':28B,72C 'allow':79C 'appsettings.json':64B,115C 'arbitrari':57B,84C 'attack':92C 'authent':47B,80C 'check':110C 'contain':73C,109C 'cve':13A,16A 'documentnam':36B,88C 'expos':67B 'file':12A,58B,85C,113C 'flaw':33B 'getdocu':42B,102C 'getimag':44B,104C 'handler':45B 'host':23B 'imagenam':38B,90C 'includ':49B 'indotal':1A,19B,25B,69C 'let':5A 'like':114C 'one':50B 'paramet':39B,91C 'path':3A,31B,75C 'path.combine':107C 'read':10A,56B,83C,112C 'regist':54B,96C 'secret':68B 'self':22B,53B,95C 'self-host':21B 'self-regist':52B,94C 'sequenc':100C 'server':11A,61B 'sign':7A 'signed-in':6A 'suppli':98C 'travers':4A,32B,76C,99C 'use':106C 'user':9A,48B,81C 'via':86C 'vulner':77C 'whms':2A,24B,26B,70C 'without':108C","nicknames":[],"mitigations":[],"who_affected":"Any WHMS deployment before `10.20261109` where users can log in, especially if self-registration is enabled. The flaw sits in the document and image retrieval endpoints, so exposure depends on those endpoints being reachable by authenticated users. Teams running the product should check their version first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","indotalent","other","selfhosted","whms"],"campaign_type":null,"search_a":"'-125385':15A,18A '-2026':14A,17A 'cve':13A,16A 'file':12A 'indotal':1A 'let':5A 'path':3A 'read':10A 'server':11A 'sign':7A 'signed-in':6A 'travers':4A 'user':9A 'whms':2A","search_b":"'10.20261109':28B 'appsettings.json':64B 'arbitrari':57B 'authent':47B 'documentnam':36B 'expos':67B 'file':58B 'flaw':33B 'getdocu':42B 'getimag':44B 'handler':45B 'host':23B 'imagenam':38B 'includ':49B 'indotal':19B,25B 'one':50B 'paramet':39B 'path':31B 'read':56B 'regist':54B 'secret':68B 'self':22B,53B 'self-host':21B 'self-regist':52B 'server':61B 'travers':32B 'user':48B 'whms':24B,26B","search_c":"'10.20261109':72C 'allow':79C 'appsettings.json':115C 'arbitrari':84C 'attack':92C 'authent':80C 'check':110C 'contain':73C,109C 'documentnam':88C 'file':85C,113C 'getdocu':102C 'getimag':104C 'imagenam':90C 'indotal':69C 'like':114C 'paramet':91C 'path':75C 'path.combine':107C 'read':83C,112C 'regist':96C 'self':95C 'self-regist':94C 'sequenc':100C 'suppli':98C 'travers':76C,99C 'use':106C 'user':81C 'via':86C 'vulner':77C 'whms':70C 'without':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125385","severity":null,"published_at":"2026-11-10T00:17:11+00:00","modified_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111550,"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111551,"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111552,"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111561,"url":"https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-path-traversal-via-filedocument-getdocument-and-fileimage-getimage","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}