CVE-2026-104706 in MiVoice Office 400
Summary
by MITRE • 10/05/2026
DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
A critical directory traversal vulnerability exists within the administrative interface of Digital Canyon systems, specifically affecting the log viewing functionality accessible through the web portal on port 8443. This flaw is located in the component responsible for processing user requests to view system logs via the Administration menu path labeled View Logs. The underlying technical defect stems from insufficient sanitization and validation of input parameters supplied by the attacker. When a request is made to retrieve log files, the application fails to properly neutralize special characters that represent parent directory references, such as dot-dot-slash sequences or their encoded variants. This oversight allows an authenticated user with administrative privileges to manipulate the file path argument, causing the server to resolve paths outside of the intended secure logging directory and instead access arbitrary locations on the underlying operating system's filesystem.
The operational impact of this vulnerability is severe due to its potential for unauthorized information disclosure. An attacker who has obtained valid credentials for an administrator account can exploit this flaw to read sensitive configuration files, application source code, database connection strings containing plaintext passwords, or other critical system artifacts stored in directories that are not meant to be publicly accessible via the web interface. This capability effectively bypasses standard access controls designed to isolate log data from core system resources. The exposure of such information can lead directly to further compromise scenarios, including credential theft, reverse engineering of proprietary logic, and identification of additional attack vectors based on exposed internal network configurations or software versions.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where an application does not properly validate user-supplied input for path traversal sequences before using it in file operations. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques under Tactic TA0006: Credential Access and specifically Technique T1530: Data from Cloud or On-Premises Storage if the accessed files contain credentials, or generally falls under data exfiltration methods where an adversary retrieves sensitive information from a compromised system. The vulnerability represents a classic instance of insecure direct object reference combined with path traversal, highlighting gaps in input validation logic within enterprise management consoles.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Digital Canyon should release a software patch that enforces strict allow-listing for file paths accessed by the log viewer component. The application code must be updated to canonicalize all user-supplied path inputs and verify that the resolved absolute path remains strictly within the designated logs directory, rejecting any request where the final path deviates from this boundary. Additionally, implementing principle of least privilege is essential; administrative interfaces should not require broad filesystem access rights unless absolutely necessary for functionality. Security controls such as Web Application Firewalls can provide a temporary layer of defense by detecting and blocking common traversal patterns in HTTP requests targeting port 8443, though this serves only as an interim measure until the code-level vulnerability is resolved. Regular security audits and static application security testing should be integrated into the development lifecycle to prevent similar input validation failures in future releases.