CVE-2026-2753

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

• CWE-36

• https://cydome.io/vulnerability-advisory-cve-2026-2753-in-navtor-navbox-version-4-12-0-3Third Party Advisory
• https://www.navtor.com/navtor-vendor-statementVendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27522OpenClaw versions prior to 2026.2.24 contain a local media r…5.5
• CVE-2026-27523OpenClaw versions prior to 2026.2.24 contain a sandbox bind …7.5
• CVE-2026-27524OpenClaw versions prior to 2026.2.21 accept prototype-reserv…4.3
• CVE-2026-27527Rejected reason: Not used
• CVE-2026-27528Rejected reason: Not used
• CVE-2026-27529Rejected reason: Not used
• CVE-2026-27530Rejected reason: Not used
• CVE-2026-27531Rejected reason: Not used
• CVE-2026-27532Rejected reason: Not used
• CVE-2026-27533Rejected reason: Not used
• CVE-2026-27534Rejected reason: Not used
• CVE-2026-2754Navtor NavBox exposes sensitive configuration and operationa…7.5