{"id":"CVE-2026-25575","summary":"NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality","details":"NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7.","aliases":["GHSA-59hj-f48w-hjfm"],"modified":"2026-08-12T03:51:22.730294123Z","published":"2026-02-04T21:54:38.258Z","database_specific":{"cwe_ids":["CWE-23","CWE-26"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25575.json","unresolved_ranges":[{"extracted_events":[{"fixed":"86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25575.json"},{"type":"ADVISORY","url":"https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25575"},{"type":"FIX","url":"https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"},{"type":"FIX","url":"https://github.com/TUM-Dev/NavigaTUM/pull/2650"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tum-dev/navigatum","events":[{"introduced":"0"},{"fixed":"86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25575.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}