CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.

• CWE-22

• https://github.com/fangtang7/CVE/blob/main/WookTeam/fileread.md

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88389Espruino 2v29 (commit bffc6d0) contains a NULL pointer deref…6.2
• CVE-2026-8839The MapPress Maps for WordPress plugin for WordPress is vuln…5.3
• CVE-2026-88390An out-of-bounds write vulnerability in jslGetTokenValueAsSt…7.7
• CVE-2026-88391Northstar (dromara/northstar, quantitative trading platform)…9.8
• CVE-2026-88392Unimall v4 is vulnerable to Directory Traversal in FileUploa…7.5
• CVE-2026-88393WookTeam v1.6.6 and before is vulnerable to RCE in the proje…9.8
• CVE-2026-88395GouGuOA v6.0.5 and before is vulnerable to SQL Injection in …9.8
• CVE-2026-88396ApiAdmin v5.0 and before is vulnerable to Directory Traversa…7.2
• CVE-2026-88397ApiAdmin v.5.0 and before is vulnerable to SQL Injection in …6.5
• CVE-2026-8840The Booking calendar, Appointment Booking System plugin for …5.3
• CVE-2026-88402A SQL injection vulnerability in the checkSQL function of no…9.8
• CVE-2026-88403A Server-Side Request Forgery (SSRF) in the serverRequest fu…6.5