{"id":"CVE-2026-101142","state":"PUBLISHED","title":"Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal","description":"A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-28T19:30:11.384Z","updatedAt":"2026-10-20T22:25:53.402Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Eleveo Quality Management"],"affected":[{"vendor":"Eleveo","product":"Quality Management","versions":[{"version":"9.7.0","status":"affected"}],"cpes":["cpe:2.3:a:eleveo:quality_management:*:*:*:*:*:*:*:*"],"modules":["Questionnaire Audio Upload"]}],"references":["https://vuldb.com/vuln/410994","https://vuldb.com/vuln/410994/cti","https://vuldb.com/cve/CVE-2026-101142","https://vuldb.com/submit/894895","https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101142"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101142.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101142","state":"PUBLISHED","datePublished":"2026-09-28T19:30:11.384Z","dateUpdated":"2026-10-20T22:25:53.402Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-28T08:11:21.155Z"},"containers":{"cna":{"title":"Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal","descriptions":[{"lang":"en","value":"A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Eleveo","product":"Quality Management","versions":[{"version":"9.7.0","status":"affected"}],"cpes":["cpe:2.3:a:eleveo:quality_management:*:*:*:*:*:*:*:*"],"modules":["Questionnaire Audio Upload"]}],"references":[{"url":"https://vuldb.com/vuln/410994","name":"VDB-410994 | Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/410994/cti","name":"VDB-410994 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-101142","name":"CVE-2026-101142 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894895","name":"Submit #894895 | Eleveo Quality Management 9.7.0 Arbitrary File Read and Deletion","tags":["third-party-advisory"]},{"url":"https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101142","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"Path Traversal"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-20T22:25:53.402Z"},"timeline":[{"time":"2026-04-05T00:00:00.000Z","lang":"en","value":"Vendor informed"},{"time":"2026-09-28T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-28T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-21T00:30:48.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Omar Elshopky (Spark Professional Services)","type":"finder"},{"lang":"en","value":"omarelshopky (VulDB User)","type":"reporter"},{"lang":"en","value":"omarelshopky (VulDB User)","type":"analyst"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T14:52:22.217088Z","id":"CVE-2026-101142","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-01T14:52:31.929Z"}}]}}}