CVE-2026-63303
NoneCVSS
—
EPSS
0.6%
Published
Jul 28, 2026
CISA due date
—
The record
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. CWE-23
- CVE-2026-119553 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through… CWE-23
- CVE-2026-107239 A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to… CWE-23
- CVE-2026-90727 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-23
- CVE-2026-68866 PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release… CWE-23
- CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi… CWE-23
- CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal… CWE-23
- CVE-2026-83923 Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute… CWE-23