# CVE-2026-1018: Gotac Police Statistics Database System path traversal arbitrary file read

Source: https://junglewise.ai/threats/cve-2026-1018-gotac-police-statistics-database-system-path-traversal-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-16. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-1018 · Severity: info · CVSS 7.5 · Published 2026-01-16

The Gotac Police Statistics Database System contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By exploiting this weakness, an attacker could remotely download internal system files without needing a username or password. This could lead to the exposure of confidential police data or system configuration details, potentially compromising the entire database operation.

Technologies: [Gotac Police Statistics Database System](https://junglewise.ai/threats/technologies/police-statistics-database-system). Vendors: [Gotac](https://junglewise.ai/threats/vendors/gotac).

## Quick answers

**Is CVE-2026-1018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1018 being exploited in the wild.

**How severe is CVE-2026-1018?** Informational severity, with a CVSS score of 7.5, published 16 January 2026.

**Which products and versions are affected?** Gotac Police Statistics Database System up to 1.0.2.

**Is there a fix for CVE-2026-1018?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1018 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1018?** Check whether you run Gotac Police Statistics Database System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Gotac Police Statistics Database System (versions up to 1.0.2) is vulnerable to an arbitrary file read flaw. The root cause is an absolute path traversal vulnerability (CWE-36) that fails to properly sanitize user-supplied input used to reference files. An unauthenticated remote attacker can exploit this by sending specially crafted network requests to access and download sensitive system files outside of the intended web directory. Although the CVE was later marked as rejected by the CNA, the initial technical analysis identified a high-severity impact on confidentiality.

## Affected products

- Gotac Police Statistics Database System up to 1.0.2

## Timeline

- 2026-01-15: disclosed: Initial disclosure by TWCERT/CC
- 2026-01-16: advisory: NVD publication date
- 2026-07-30: other: CVE marked as Rejected by TWCERT/CC

## Related threats

- [Gotac Police Statistics Database System arbitrary file upload](https://junglewise.ai/threats/cve-2026-1021-gotac-police-statistics-database-system-arbitrary-file-upload)
- [Gotac Police Statistics Database System path traversal](https://junglewise.ai/threats/cve-2026-1020-gotac-police-statistics-database-system-path-traversal)
- [Gotac Police Statistics Database System missing authentication](https://junglewise.ai/threats/cve-2026-1019-gotac-police-statistics-database-system-missing-authentication)