Executive brief
dataCycle-CORE is a data management system used for centralizing and distributing corporate information. A security flaw in its documentation viewer allows unauthorized users to access internal system files that were intended to be private. This could lead to the exposure of sensitive configuration data or internal documentation, potentially aiding further attacks against the organization's infrastructure.
Technical details
A path traversal vulnerability (CWE-22) exists in the documentation and static markdown rendering module of dataCycle-CORE. The application fails to properly sanitize path segments, relying solely on a Rails HTML sanitizer which does not filter directory traversal sequences like '../'. An unauthenticated remote attacker can exploit this by providing crafted path segments to the /docs/*path or static endpoints. This allows the attacker to traverse outside of the restricted directories and read arbitrary Markdown (.md) files located in the application or engine root. The issue is resolved in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD