Is CVE-2026-49488 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49488 being exploited in the wild.

How severe is CVE-2026-49488?

Informational severity, published 14 July 2026.

Which products and versions are affected?

Apache Software Foundation OpenMeetings 5.0.0 to 9.0.x (fixed in 9.1.0).

Is there a fix for CVE-2026-49488?

A patch was published on 2026-07-14: Fixed in version 9.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49488 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49488?

Check whether you run Apache Software Foundation OpenMeetings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49488: Apache OpenMeetings path traversal in file download functionality

CVE-2026-49488 · Severity: info · Published 2026-07-14

Apache OpenMeetings, a web-based application for video conferencing and collaboration, is vulnerable to a security flaw that allows room moderators to access sensitive files on the server. By sending a specially crafted download request, an authorized moderator could steal system credentials, configuration secrets, or other private data stored on the host machine. This could lead to a full compromise of the server or unauthorized access to other corporate systems.

Technologies: Apache Software Foundation OpenMeetings. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-49488 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49488 being exploited in the wild.
How severe is CVE-2026-49488?: Informational severity, published 14 July 2026.
Which products and versions are affected?: Apache Software Foundation OpenMeetings 5.0.0 to 9.0.x (fixed in 9.1.0).
Is there a fix for CVE-2026-49488?: A patch was published on 2026-07-14: Fixed in version 9.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49488 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49488?: Check whether you run Apache Software Foundation OpenMeetings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Apache OpenMeetings versions 5.0.0 through 9.0.x. The flaw resides in the file download functionality, where the application fails to properly sanitize or limit pathnames to restricted directories. An attacker authenticated with moderator privileges in any room can submit a crafted download request to escape the intended directory and read any file accessible to the operating system account running the OpenMeetings server. This includes sensitive configuration files, credentials, and application secrets. The issue is resolved in version 9.1.0.

Affected products

Apache Software Foundation OpenMeetings 5.0.0 to 9.0.x (fixed in 9.1.0)

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-07-14: patched: Fixed in version 9.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.