What’s Vulnerable › Vulnerabilities

CVE-2026-92970: HUBzero CMS through 2.2.32 Path Traversal via File Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-09-22
• Weakness: CWE-22

Description

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

Affected products

• hubzero-cms: through 2.2.32

References

• https://github.com/hubzero/hubzero-cms
• https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/components/com_projects/api/controllers/filesv1_0.php#L809-L880
• https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Filesystem/Entity.php#L53-L73
• https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/plugins/projects/files/connections.php#L812-L815
• https://github.com/hubzero/hubzero-cms/commit/4a58215463e5d42f8d03567358171383da939946
• https://github.com/hubzero/hubzero-cms/commit/5b4c4aefedf647390465cdfd0e7fa626c3e1cb39
• https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-path-traversal-via-file-upload

Get alerted when CVE-2026-92970 or the next vulnerability affects your stack