CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name could therefore move an uploaded file outside the intended storage directory, enabling unauthorized file placement or overwrite with the privileges of the application process. This issue is fixed in version 1.6.8.

• CWE-22

• https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57
• https://github.com/hargata/lubelog/issues/1398
• https://github.com/hargata/lubelog/pull/1395
• https://github.com/hargata/lubelog/releases/tag/v1.6.8
• https://github.com/hargata/lubelog/security/advisories/GHSA-qm5x-mmwx-q7rm

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62263Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-62264PDF Reader MCP is a Model Context Protocol server for readin…7.5
• CVE-2026-62268borgbackup is an opensource, deduplicating archiver with com…5.3
• CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
• CVE-2026-62275Detection of error condition without action in the MigTD's v…5.6
• CVE-2026-62277LubeLogger is a self-hosted, open-source, web-based vehicle …6.5
• CVE-2026-62279LubeLogger is a self-hosted, open-source, web-based vehicle …7.1
• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62280Open Access Management (OpenAM) is an access management solu…6.1
• CVE-2026-62282OpenCVE is a vulnerability intelligence platform. Prior to 3…6.5
• CVE-2026-62283Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
• CVE-2026-62284OSAC operator is a Kubernetes operator. In the affected revi…8.6