CVE-2026-94834
Arbitrary file read in download.php via path traversal
| CVE | CVE-2026-94834 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (download.php:34-36) |
| CWE | CWE-22 |
| CVSS 3.1 | 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
download.php:40 concatenates $upload_path . $_GET['year'] . $_GET['file'] with no traversal check. Admin-only, but it crosses the trust boundary out of the upload directory: file=../../config_db.php yields the database credentials.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94834.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch