CVE-2026-2493

IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The specific flaw exists within handling of the ticket parameter provided to the collaboration endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-25440.

• CWE-22

• https://www.zerodayinitiative.com/advisories/ZDI-26-130/

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24924Vulnerability of improper permission control in the print mo…5.5
• CVE-2026-24925Heap-based buffer overflow vulnerability in the image module…5.5
• CVE-2026-24926Out-of-bounds write vulnerability in the camera module. Impa…5.5
• CVE-2026-24927Out-of-bounds access vulnerability in the frequency modulati…5.5
• CVE-2026-24928Out-of-bounds write vulnerability in the file system module.…5.5
• CVE-2026-24929Out-of-bounds read vulnerability in the graphics module. Imp…4.4
• CVE-2026-24930UAF concurrency vulnerability in the graphics module. Impact…5.5
• CVE-2026-24931Vulnerability of improper criterion security check in the ca…5.5
• CVE-2026-24932The DDNS update function in ADM fails to properly validate t…5.9
• CVE-2026-24933The API communication component fails to validate the SSL/TL…5.9
• CVE-2026-24934The DDNS function uses an insecure HTTP connection or fails …3.7
• CVE-2026-24935A third-party NAT traversal module fails to validate SSL/TLS…5.6