Quick answers
- Is CVE-2026-48083 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48083 being exploited in the wild.
- How severe is CVE-2026-48083?
- Medium severity, with a CVSS score of 6.5, published 6 August 2026.
- Which products and versions are affected?
- OpenReception Appointment-Booking-Software <1.0.2.
- Is there a fix for CVE-2026-48083?
- A patch was published on 2026-08-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48083 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-48083?
- Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The `/api/log` endpoint exhibits a log-injection vulnerability caused by three missing security controls: lack of authentication, absence of input schema validation, and no rate or size limits. The vulnerability accepts unauthenticated POST requests, writes user-supplied JSON message content directly to stdout without sanitization, and interprets CRLF characters as real line breaks. An attacker can craft a POST request with embedded newlines to forge log lines that mimic legitimate system errors (e.g., `[error]: injected admin error`), making them indistinguishable from genuine application output when persisted to disk. Additionally, the endpoint permits payloads up to at least 100 KB with no observed rate limiting, enabling a volume-based denial-of-service attack that can sustain ~100 requests per second from a single source and potentially exhaust disk space. The vulnerability requires no authentication, session cookies, or prior access; any network-accessible attacker can exploit it. Version 1.0.2 applies input sanitization and rate limiting to fix the issue.
Affected products
- OpenReception appointment-booking-software <1.0.2
Timeline
- 2026-05-20: disclosed
- 2026-08-06: patched