# CVE-2026-57871: MicroRealEstate path traversal in file upload functionality

Source: https://junglewise.ai/threats/cve-2026-57871-microrealestate-path-traversal-in-file-upload-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-57871 · Severity: info · CVSS 7.1 · Published 2026-07-07

MicroRealEstate, an open-source property management platform, contains a security flaw in its file upload system. An attacker can exploit this to save files in unauthorized locations on the server, potentially overwriting critical system files. This could lead to severe service disruptions, data corruption, or a complete system crash.

## Quick answers

**Is CVE-2026-57871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57871 being exploited in the wild.

**How severe is CVE-2026-57871?** Informational severity, with a CVSS score of 7.1, published 7 July 2026.

**Which products and versions are affected?** MicroRealEstate MicroRealEstate through 1.0.0-alpha3.

**Is there a fix for CVE-2026-57871?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57871 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57871?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability (CWE-23) exists in the file upload functionality of MicroRealEstate through version 1.0.0-alpha3. The application uses parameters passed directly in a URL to determine the destination file path when writing uploaded files to disk. A remote attacker with low privileges can manipulate these parameters to traverse directories and write files to unauthorized locations. This can result in the overwriting of critical system files, leading to a denial of service or platform corruption. As of the advisory date, no fixed version has been identified.

## Affected products

- MicroRealEstate MicroRealEstate through 1.0.0-alpha3

## Timeline

- 2026-07-07: advisory: Advisory published by The Missing Link Australia and NVD

## References

- [https://github.com/microrealestate/microrealestate](https://github.com/microrealestate/microrealestate)
- [https://www.themissinglink.com.au/security-advisories/cve-2026-57871](https://www.themissinglink.com.au/security-advisories/cve-2026-57871)