CVE-2026-2753

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-06 · updated 2026-06-17
Weakness: CWE-36

Description

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

Affected products

Navtor NavBox: from 4.12.0.3 before 4.14.1.2 — fixed in 4.14.1.2

How to fix

Upgrade to a fixed version: Navtor NavBox 4.14.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-2753 or the next vulnerability affects your stack