CVE-2026-63162

HIGH 8.8

Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

CWE	CWE-22
Vendor	omnispace
Product	agora project
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for omnispace agora project

Be the first to know when new high vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Omnispace / Agora Project

0 < 26.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xech/agora-project/releases/tag/26.10 agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-path-traversal-via-tmpfoldername-parameter

Credits

Geoffrey Robert of akailabs