{"id":"CVE-2026-8464","state":"PUBLISHED","title":"Path traversal in Neuron Soft Golem OEE MES","description":"Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths.\nThis issue has been fixed in version 11.6.0","publishedAt":"2026-06-11T10:32:23.977Z","updatedAt":"2026-06-11T12:13:26.247Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Neuron Soft Golem OEE MES"],"affected":[{"vendor":"Neuron Soft","product":"Golem OEE MES","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.6.0","versionType":"custom"}]}],"references":["https://www.neuron.com.pl/mes-help/mes-download.html","https://cert.pl/posts/2026/06/CVE-2026-8464"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/8xxx/CVE-2026-8464.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-8464","state":"PUBLISHED","datePublished":"2026-06-11T10:32:23.977Z","dateUpdated":"2026-06-11T12:13:26.247Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-05-13T11:32:03.878Z"},"containers":{"cna":{"title":"Path traversal in Neuron Soft Golem OEE MES","descriptions":[{"lang":"en","value":"Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths.\nThis issue has been fixed in version 11.6.0"}],"affected":[{"vendor":"Neuron Soft","product":"Golem OEE MES","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.6.0","versionType":"custom"}]}],"references":[{"url":"https://www.neuron.com.pl/mes-help/mes-download.html","tags":["release-notes"]},{"url":"https://cert.pl/posts/2026/06/CVE-2026-8464","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-06-11T10:32:23.977Z"},"credits":[{"lang":"en","type":"finder","value":"Karol Królak (securitum.pl)"}],"datePublic":"2026-06-11T10:31:00.000Z","source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-11T12:11:55.899095Z","id":"CVE-2026-8464","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-11T12:13:26.247Z"}}]}}}