datacycle-engine dataCycle-CORE up to 25.07.3 Markdown Renderer path traversal

Summaryinfo

A vulnerability was found in datacycle-engine dataCycle-CORE up to 25.07.3 and classified as problematic. The affected element is an unknown function of the component Markdown Renderer. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-32820. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in datacycle-engine dataCycle-CORE up to 25.07.3 and classified as problematic. This vulnerability affects an unknown code of the component Markdown Renderer. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove directory traversal sequences. An unauthenticated attacker can traverse out of the intended `docs` or `static` directories and render arbitrary `.md` files from the application root or engine root. This is patched in version 26.06.08.

The advisory is available at github.com. This vulnerability was named CVE-2026-32820 since 03/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 26.06.08 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• datacycle-engine

Name

• dataCycle-CORE

Version

• 25.07.0
• 25.07.1
• 25.07.2
• 25.07.3

Website

• Product: https://github.com/datacycle-engine/dataCycle-CORE/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion