CVE-2026-93014 in RosarioSIS
Summary
by MITRE • 09/17/2026
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in RosarioSIS prior to version 12.9 represents a critical security flaw rooted in insufficient input validation within the Users and Students modules of the application. This specific weakness allows authenticated attackers to manipulate file system operations through path traversal techniques, specifically by exploiting how the software handles filename request parameters. The core technical failure lies in the absence of rigorous sanitization or canonicalization checks on user-supplied data before it is processed for file deletion operations. By injecting parent-directory sequences such as dot-dot-slash into these parameters, an attacker can bypass intended directory boundaries and access files located outside the designated upload directories where they are permitted to operate.
This lack of validation directly facilitates unauthorized unlinking of allow-listed files across the entire installation environment. The operational impact is severe because it enables attackers to delete critical system resources including Cascading Style Sheets, Extensible Markup Language configurations, JavaScript Object Notation data structures, and other users' private documents. Such actions can lead to significant service disruption by breaking application styling or configuration integrity, as well as causing irreversible loss of important educational records and personal information stored within the student and user modules. The ability to traverse directories effectively neutralizes any security controls that rely on directory isolation for access restriction, turning a simple file management feature into a vector for widespread data destruction.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-650 Trust Boundary Violation within the application logic. In terms of adversary behavior as defined by MITRE ATT&CK, this exploitation technique corresponds to T1485 Data Destruction or potentially T1070 Indicator Removal on Host if used to cover tracks after deletion. The attack requires authentication, which places it in categories involving authenticated access but highlights a failure in enforcing proper authorization checks for file system operations based on the context of the request parameter.
Mitigation strategies must focus primarily on upgrading RosarioSIS to version 12.9 or later where these validation mechanisms have been addressed. In environments where immediate patching is not feasible, administrators should implement strict input validation at the application layer by rejecting any filename parameters containing relative path sequences like dot-dot-slash before they are processed. Additionally, deploying a web application firewall with rules designed to detect and block directory traversal attempts can provide an additional layer of defense. It is also advisable to review file system permissions on the server hosting RosarioSIS to ensure that even if such vulnerabilities exist, the operating system level restrictions limit the potential damage by preventing access to sensitive directories outside the intended scope of the web application user account.