CVE-2026-40526

Volmarg Personal Management System contains a path traversal flaw (CWE-22) in the GET /public/get-file/{path} endpoint, where the route parameter is passed directly to PHP's file_get_contents() without canonicalization or confinement to a permitted base directory. An authenticated attacker can trigger it simply by supplying an absolute filesystem path (e.g., starting with a leading slash) in the path parameter, without needing any directory traversal sequences. Successful exploitation lets the attacker read any file accessible to the PHP-FPM worker process, potentially exposing application configuration, credentials, environment files, and system files such as /etc/passwd, which could enable further compromise of the host. Any self-hosted deployment that grants accounts to users other than fully trusted operators is affected, with internet-exposed instances at the greatest risk. As of this analysis there is no known exploitation, no public proof-of-concept, and the issue is not in CISA KEV; EPSS estimates roughly a 0.6% chance of exploitation in the next 30 days.

What to do: Upgrade to the vendor's fixed release as soon as one is published, since no patched version number is available in the current data; in the interim, restrict access to the /public/get-file/ endpoint to trusted users and, if using a reverse proxy or WAF, reject requests whose path parameter begins with an absolute path (e.g., leading '/') or contains traversal sequences. Audit which sensitive files (config files, credentials, SSH keys) are readable by the PHP-FPM worker user, and review access logs for requests to /public/get-file/ containing absolute paths that could indicate probing.