CVE-2026-1020: Gotac Police Statistics Database System path traversal

CVE-2026-1020 · Severity: info · CVSS 5.3 · Published 2026-01-16

The Gotac Police Statistics Database System, used for managing law enforcement data, contains a security flaw that allows unauthorized individuals to view internal system files. An attacker could use this to map out the server's directory structure and potentially access sensitive configuration or system information. This could lead to further targeted attacks against the organization's infrastructure.

Technologies: Gotac Police Statistics Database System. Vendors: Gotac.

Quick answers

Is CVE-2026-1020 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1020 being exploited in the wild.
How severe is CVE-2026-1020?
Informational severity, with a CVSS score of 5.3, published 16 January 2026.
Which products and versions are affected?
Gotac Police Statistics Database System up to and including 1.0.3.
Is there a fix for CVE-2026-1020?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1020 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1020?
Check whether you run Gotac Police Statistics Database System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An absolute path traversal vulnerability (CWE-36) exists in the Gotac Police Statistics Database System through version 1.0.3. The flaw allows an unauthenticated remote attacker to bypass directory restrictions by providing absolute file paths to vulnerable parameters. Successful exploitation enables the attacker to enumerate the system file directory and potentially read sensitive files, though the reported impact is limited to low confidentiality loss. While the CVE was later marked as rejected by the CNA, the technical details indicate a network-based attack vector with no user interaction required.

Affected products

  • Gotac Police Statistics Database System up to and including 1.0.3

Timeline

  • 2026-01-15: advisory: Initial disclosure by TWCERT/CC
  • 2026-01-16: disclosed: NVD publication date
  • 2026-07-30: other: CVE marked as rejected/withdrawn by CNA

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.