# CVE-2026-104743: Tainacan directory traversal in importer tmp_file parameter

Source: https://junglewise.ai/threats/cve-2026-104743-the-tainacan-plugin-for-wordpress-is-vulnerable-to-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-104743 · Severity: medium · CVSS 4.9 · Published 2026-10-28

Tainacan is a WordPress plugin for managing and displaying digital collections. The vulnerability allows authenticated editors and administrators to read arbitrary files from the server through a directory traversal flaw in the file import feature, potentially exposing sensitive configuration files or database credentials. An attacker must have editor-level access or higher to exploit this issue.

Technologies: [Tainacan](https://junglewise.ai/threats/technologies/tainacan). Vendors: [Tainacan](https://junglewise.ai/threats/vendors/tainacan).

## Quick answers

**Is CVE-2026-104743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104743 being exploited in the wild.

**How severe is CVE-2026-104743?** Medium severity, with a CVSS score of 4.9, published 28 October 2026.

**Which products and versions are affected?** Tainacan up to and including 1.3.0.

**Is there a fix for CVE-2026-104743?** Yes: fixed in 1.3.1 (fix committed 2026-10-02). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104743 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104743?** Check whether you run Tainacan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.3.1 (fix committed 2026-10-02)

## Technical details

The plugin fails to properly validate the 'tmp_file' parameter in the importer endpoint, allowing authenticated users to traverse directories and specify arbitrary file paths. The malicious path is stored in the database and later retrieved via a GET request to the /source_info endpoint, where it is passed unsanitized to fopen() and fgetcsv() functions, returning parsed file contents in the REST API response. This is a path traversal (directory traversal) vulnerability requiring authentication and elevated privileges.

## Affected products

- Tainacan Tainacan up to and including 1.3.0

## Timeline

- 2026-10-28: disclosed
- 2026-10-02: other: Fix committed to repository

## References

- [https://github.com/tainacan/tainacan/commit/1cc2c179d213670ae4bd378473d6fecbc35c6357](https://github.com/tainacan/tainacan/commit/1cc2c179d213670ae4bd378473d6fecbc35c6357)
- [https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php](https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php)

## Related threats

- [Tainacan plugin for WordPress directory traversal in guid parameter](https://junglewise.ai/threats/cve-2026-93767-the-tainacan-plugin-for-wordpress-is-vulnerable-to-directory)
- [Tainacan SQL injection in subscriber functionality](https://junglewise.ai/threats/cve-2026-95590-subscriber-sql-injection-in-tainacan-1-2-0-versions)
- [Tainacan WordPress plugin SQL injection in geoquery parameter](https://junglewise.ai/threats/cve-2026-6230-tainacan-wordpress-plugin-sql-injection-in-geoquery-parameter)
- [Tainacan SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-42740-tainacan-sql-injection-in-wordpress-plugin)