CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name could therefore move an uploaded file outside the intended storage directory, enabling unauthorized file placement or overwrite with the privileges of the application process. This issue is fixed in version 1.6.8.

• CWE-22

• https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57
• https://github.com/hargata/lubelog/issues/1398
• https://github.com/hargata/lubelog/pull/1395
• https://github.com/hargata/lubelog/releases/tag/v1.6.8
• https://github.com/hargata/lubelog/security/advisories/GHSA-qm5x-mmwx-q7rm

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62249Weblate is a web-based continuous localization platform used…4.3
• CVE-2026-6225The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-6226The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62262Piwigo is a full featured open source photo gallery applicat…9.1
• CVE-2026-62263Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
• CVE-2026-62279LubeLogger is a self-hosted, open-source, web-based vehicle …7.1
• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62280Open Access Management (OpenAM) is an access management solu…6.1
• CVE-2026-62282OpenCVE is a vulnerability intelligence platform. Prior to 3…6.5
• CVE-2026-62283Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
• CVE-2026-62286Dozzle is a realtime log viewer for docker containers. Prior…4.3