CVE-2026-2216

Summary

A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used.

Affected Software

VendorProductVersion RangeStatus
rachelosWeRSS we-mp-rss1.4.0affected
rachelosWeRSS we-mp-rss1.4.1affected
rachelosWeRSS we-mp-rss1.4.2affected
rachelosWeRSS we-mp-rss1.4.3affected
rachelosWeRSS we-mp-rss1.4.4affected
rachelosWeRSS we-mp-rss1.4.5affected
rachelosWeRSS we-mp-rss1.4.6affected
rachelosWeRSS we-mp-rss1.4.7affected
rachelosWeRSS we-mp-rss1.4.8affected

Weaknesses

  • CWE-22: Path Traversal

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References