Quick answers
- Is CVE-2026-40526 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40526 being exploited in the wild.
- How severe is CVE-2026-40526?
- Medium severity, with a CVSS score of 6.5, published 27 August 2026.
- Which products and versions are affected?
- Volmarg Personal Management System <unknown.
- Is there a fix for CVE-2026-40526?
- A patch was published on 2026-08-27: Fix applied in commit a044357 to use str_starts_with() instead of str_contains() Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40526 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-40526?
- Check whether you run Volmarg Personal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The GET /public/get-file/{path} endpoint passes the path parameter directly to file_get_contents() without proper validation. Although the application intended to restrict file access to specific directories, the validation logic used str_contains() which checked only if the directory name appeared anywhere in the path, not that the path started with an allowed directory. An authenticated attacker can supply absolute filesystem paths or paths containing the allowed directory name in the middle to escape the intended base directory and retrieve arbitrary files. The vulnerability requires authentication but is otherwise trivial to exploit. The fix involves replacing str_contains() with str_starts_with() to properly enforce that file paths begin with an allowed directory.
Affected products
- Volmarg Personal Management System <unknown
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fix applied in commit a044357 to use str_starts_with() instead of str_contains()