CVE-2026-36723

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-22

Description

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).

References

https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-17

Get alerted when CVE-2026-36723 or the next vulnerability affects your stack