{"id":"CVE-2026-76806","kind":"vulnerability","aliases":["CVE-2026-76806"],"related":[],"title":"Solidtime: Toggl import path traversal creates directories and leaks host layout","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","summary":"Solidtime's Toggl data importer built filesystem paths from project ids in uploaded ZIP files without validation, so crafted ids can escape the temporary folder and create directories elsewhere on the host. Import responses also reveal whether certain host paths exist, which leaks host layout information.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["laravel","package","php","self-hosted","solidtime"],"not_affected_if":["import-disabled","version-0.16.0-or-later"],"how_to_check":"- Check the installed Solidtime version and see whether it is below `0.16.0`\n- Look for the import endpoint `POST /api/v1/organizations/{org}/import` with `type=toggl_data_importer` in your deployment logs","fix":"- Solidtime: move to `0.16.0` or later","status":"open","published_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","triaged_at":"2026-11-04T20:30:03+00:00","updated_at":"2026-11-04T20:30:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T20:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Solidtime: move to `0.16.0` or later","reach":"internet","title":"Solidtime: Toggl import path traversal creates directories and leaks host layout","impact":"low","summary":"Solidtime's Toggl data importer built filesystem paths from project ids in uploaded ZIP files without validation, so crafted ids can escape the temporary folder and create directories elsewhere on the host. Import responses also reveal whether certain host paths exist, which leaks host layout information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["solidtime","self-hosted","php","laravel"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker creates directories on host and learns file existence","analyst_note":"","how_to_check":"- Check the installed Solidtime version and see whether it is below `0.16.0`\n- Look for the import endpoint `POST /api/v1/organizations/{org}/import` with `type=toggl_data_importer` in your deployment logs\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.16.0-or-later","import-disabled"],"who_is_affected":"Self-hosted Solidtime instances before 0.16.0 where any registered user can create an organization and use the Toggl data import. Instances that do not expose the import feature to users, or that are on 0.16.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4367,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76806':14A,17A '/api/v1/organizations':174C '/import':176C '0.16.0':83C,205C 'abl':166C 'also':59B 'alway':160C 'app':80C 'append':161C 'arbitrari':127C 'attack':88C 'attacker-control':87C 'avail':189C 'built':30B 'caus':187C 'certain':62B 'concaten':100C 'constrain':143C 'control':89C 'could':118C,182C 'craft':43B 'creat':6A,51B,112C,124C,168C 'cve':12A,15A 'data':28B,180C 'deriv':146C 'directori':7A,52B,115C,125C,192C 'disclos':195C 'distinguish':131C 'elsewher':53B 'escap':46B,119C 'exhaust':193C 'exist':65B,135C,156C 'expos':139C 'file':39B 'filesystem':31B,103C 'fix':202C 'flaw':185C 'folder':49B 'host':10A,23B,56B,63B,68B,129C,144C,196C 'id':35B,44B,91C,150C,154C 'impact':190C 'import':3A,29B,57B,98C,159C,181C 'importcontrol':132C 'importdata':85C 'inform':70B,198C 'issu':200C 'json':151C,155C,162C 'laravel':18B 'layout':11A,69B,197C 'leak':9A,67B 'minor':188C 'miss':113C,137C 'open':75C 'open-sourc':74C 'org':175C 'organ':170C 'packag':19B 'parent':114C 'path':4A,32B,64B,104C,111C,130C,145C 'php':20B 'post':173C 'potenti':186C 'prior':81C 'project':34B,90C,148C 'projects.json':94C 'reach':183C 'read':86C 'regist':164C 'respons':58B,133C 'reveal':60B 'sandbox':122C 'self':22B 'self-host':21B 'sequenc':117C 'solidtim':1A,24B,25B,71C 'sourc':76C 'spati':108C 'suffix':142C 'suffix-constrain':141C 'target':138C 'task':153C 'temporari':48B,121C 'temporarydirectori':109C,110C 'time':78C 'time-track':77C 'toggl':2A,27B,179C 'toggldataimport':84C 'track':79C 'travers':5A,116C 'type':178C 'upload':37B,96C 'use':172C 'user':149C,165C 'valid':41B,106C 'valu':92C 'version':204C 'versus':136C 'whether':61B,140C 'without':40B,105C 'writabl':128C 'zip':38B,97C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Solidtime instances before 0.16.0 where any registered user can create an organization and use the Toggl data import. Instances that do not expose the import feature to users, or that are on 0.16.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["laravel","medium","package","php","selfhosted","solidtime"],"campaign_type":null,"first_public_at":"2026-07-09T18:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76806","severity":null,"published_at":"2026-11-04T20:19:12+00:00","modified_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","fetched_at":"2026-11-04T20:29:03+00:00","note":null}],"documents":[{"id":70208,"url":"https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70209,"url":"https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70210,"url":"https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-09T18:18:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}