CVE-2026-107092EUVD-2026-109893
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
NexoPOS, an open-source point-of-sale and inventory management application, is affected by a flaw that allows an attacker to access files and directories outside the intended scope through its update API endpoint. This could let an attacker read or otherwise interact with sensitive files on the server hosting the application.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
Affected versions
No affected packages have been listed by the sources.