CVE-2026-49738

CVE-2026-49738

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as v…

Vulnerability class: Path Traversal (Directory Traversal)

Weakness classification (CWE)

References