CVE-2026-61343
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| LibreBooking | LibreBooking | 0 < 5.1.0 | affected |
| LibreBooking | LibreBooking | 5.1.0 | unaffected |
Weaknesses
- CWE-23: CWE-23 Relative Path Traversal
References
- https://github.com/LibreBooking/librebooking/pull/1456
- https://github.com/LibreBooking/librebooking/releases/tag/v5.1.0
- https://github.com/LibreBooking/librebooking/commit/cb9b7ad9da0243bd105809f6a4a8a6b9147c71ea
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-61343
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.