---
id: "CVE-2026-76806"
kind: "vulnerability"
aliases: ["CVE-2026-76806"]
title: "Solidtime: Toggl import path traversal creates directories and leaks host layout"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["laravel", "package", "php", "self-hosted", "solidtime"]
not_affected_if: ["import-disabled", "version-0.16.0-or-later"]
published_at: "2026-11-04T20:19:12+00:00"
first_seen_at: "2026-11-04T20:29:03+00:00"
updated_at: "2026-11-04T20:30:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76806", "first_seen_at": "2026-11-04T20:29:03+00:00"}]
---

# Solidtime: Toggl import path traversal creates directories and leaks host layout

Solidtime's Toggl data importer built filesystem paths from project ids in uploaded ZIP files without validation, so crafted ids can escape the temporary folder and create directories elsewhere on the host. Import responses also reveal whether certain host paths exist, which leaks host layout information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Solidtime version and see whether it is below `0.16.0`
- Look for the import endpoint `POST /api/v1/organizations/{org}/import` with `type=toggl_data_importer` in your deployment logs

## Fix

- Solidtime: move to `0.16.0` or later

## Timeline

- 2026-11-04T20:29:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76806

## Documents

- [advisory] Vendor advisory: github.com https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j
- [fix] Patch: github.com https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be
- [fix] Release notes: github.com https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0

## From the sources

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\TemporaryDirectory\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_