Skip to content
Heist/ feed
Back to feed
High

HUBzero CMS through 2.2.32 Path Traversal via File Upload

Type: advisorySources: OSV

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-92970
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 20:09 UTC · Revision 1

Source evidence

HUBzero CMS through 2.2.32 Path Traversal via File Upload

core-osv · Original source

Published 17 Sept 2026, 13:43 UTC

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

osv:CVE-2026-92970
Complete source record
{
  "id": "d0aa0260f2b1ab4346e3fdb35558b7f34af5b8dde2bd2d439aa7c8c35dc0504a",
  "url": "https://osv.dev/vulnerability/CVE-2026-92970",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HUBzero CMS through 2.2.32 Path Traversal via File Upload",
    "summary": "HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.",
    "evidence": "osv:CVE-2026-92970",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-92970",
      "aliases": [
        "CVE-2026-92970"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hubzero/hubzero-cms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4a58215463e5d42f8d03567358171383da939946"
                },
                {
                  "fixed": "5b4c4aefedf647390465cdfd0e7fa626c3e1cb39"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.2.32"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4a58215463e5d42f8d03567358171383da939946"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5b4c4aefedf647390465cdfd0e7fa626c3e1cb39"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.2.31",
            "v2.2.24",
            "v2.2.30",
            "v2.2.27",
            "v2.2.28",
            "v2.2.20",
            "v2.2.25",
            "v2.2.23",
            "v2.2.22",
            "v2.2.21",
            "v2.2.19",
            "v2.2.18",
            "v2.2.17",
            "v2.2.16",
            "v2.2.15",
            "v2.2.14",
            "v2.2.13",
            "v2.2.12",
            "v2.2.11",
            "v2.2.10",
            "v2.2.9",
            "v2.2.8",
            "v2.2.7",
            "v2.2.6",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.0",
            "2.1.0-release",
            "v2.0.0.4",
            "v2.0.0.3",
            "v2.0.0.2",
            "v2.0.0.1",
            "v2.0.0.0",
            "v1.3.0.24",
            "v1.2.0",
            "v1.2.2",
            "v1.2.1",
            "v1.1.2",
            "v1.1.0-20120923.6",
            "v1.1.0",
            "v1.1.0-20120827",
            "v1.1.0-20120823",
            "v1.0.0-20110403.3",
            "v1.0.0",
            "v1.0.0-20110403.2",
            "v1.0.0-20110403.1",
            "v1.0.0-20110402.2",
            "v1.0.0-20110402.1",
            "v1.0.0-20110328.1",
            "v1.0.0-20110327.2",
            "v1.0.0-20110327.1",
            "v1.0.0-20110326.1",
            "v0.8.0-20100408.6",
            "v0.8.0-20100408.2",
            "v0.8.0",
            "v0.8.0-20100408.5",
            "v0.8.0-20100408.4",
            "v0.8.0-20100408.3",
            "v0.8.0-20100408.1",
            "v0.8.0-20100407.1",
            "v0.8.0-20100406.2",
            "v0.8.0-20100406.1",
            "v0.8.0-20100405.2",
            "v0.8.0-20100405.1",
            "v0.7.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92970.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.376292695Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92970.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-92970",
        "https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-path-traversal-via-file-upload",
        "https://github.com/hubzero/hubzero-cms/commit/4a58215463e5d42f8d03567358171383da939946",
        "https://github.com/hubzero/hubzero-cms/commit/5b4c4aefedf647390465cdfd0e7fa626c3e1cb39",
        "https://github.com/hubzero/hubzero-cms",
        "https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/components/com_projects/api/controllers/filesv1_0.php#L809-L880",
        "https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Filesystem/Entity.php#L53-L73",
        "https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/plugins/projects/files/connections.php#L812-L815"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92970.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-92970",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 489656,
  "published_at": "2026-09-17T13:43:15.223+00:00"
}