# CVE-2026-11944: OS4ED openSIS Classic path traversal in messaging attachment download

Source: https://junglewise.ai/threats/cve-2026-11944-os4ed-opensis-classic-path-traversal-in-messaging-attachment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-11944 · Severity: info · CVSS 5.3 · Published 2026-07-14

openSIS Classic, a student information system used to manage school operations, contains a security flaw in its messaging system. An authorized user, such as a student or staff member, could exploit this vulnerability to access sensitive files stored on the school's server that they are not permitted to see. This could lead to the exposure of private administrative data or system configuration files.

Technologies: [OS4ED openSIS Classic](https://junglewise.ai/threats/technologies/opensis-classic). Vendors: [OS4ED](https://junglewise.ai/threats/vendors/os4ed).

## Quick answers

**Is CVE-2026-11944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11944 being exploited in the wild.

**How severe is CVE-2026-11944?** Informational severity, with a CVSS score of 5.3, published 14 July 2026.

**Which products and versions are affected?** OS4ED openSIS Classic 9.3.

**Is there a fix for CVE-2026-11944?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11944 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11944?** Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in openSIS Classic 9.3 within the legacy messaging module. The flaw is located in the functionality responsible for downloading attachments from sent mail. An authenticated attacker can provide specially crafted input containing path traversal sequences (e.g., ../) to bypass directory restrictions. This allows the attacker to read arbitrary files on the underlying server filesystem with the privileges of the web server process. The attack requires network access and valid user credentials but no special administrative privileges.

## Affected products

- OS4ED openSIS Classic 9.3

## Timeline

- 2026-07-14: advisory: NVD and Fluid Attacks published the advisory

## References

- [https://fluidattacks.com/es/advisories/toto](https://fluidattacks.com/es/advisories/toto)
- [https://github.com/OS4ED/openSIS-Classic](https://github.com/OS4ED/openSIS-Classic)

## Related threats

- [openSIS Classic insecure direct object reference in staff password reset](https://junglewise.ai/threats/cve-2026-91107-opensis-classic-9-3-allows-an-authenticated-user-with-the-built)
- [OS4ED openSIS-Classic SQL injection in Save Data Handler](https://junglewise.ai/threats/cve-2026-103117-a-security-vulnerability-has-been-detected-in-os4ed-opensis)
- [OS4ED openSIS-Classic SQL injection in student list search](https://junglewise.ai/threats/cve-2026-103116-a-weakness-has-been-identified-in-os4ed-opensis-classic-up-to-9)
- [OS4ED openSIS-Classic SQL injection in Student Search](https://junglewise.ai/threats/cve-2026-103115-a-security-flaw-has-been-discovered-in-os4ed-opensis-classic-up)
- [OS4ED openSIS-Classic SQL injection in Assignment Management](https://junglewise.ai/threats/cve-2026-103114-a-vulnerability-was-identified-in-os4ed-opensis-classic-up-to-9)