Junglewise Threat Intelligence

CVE-2026-61343: LibreBooking path traversal in email template editor

CVE-2026-61343 · Severity: high · CVSS 7.2 · Published 2026-07-09

Executive brief

LibreBooking, an open-source reservation and booking system, contains a security flaw in its email template editor. An authorized administrator can bypass folder restrictions to save malicious files onto the server. This could allow an attacker with administrative access to take full control of the underlying web server and execute arbitrary code.

Technical details

A relative path traversal vulnerability (CWE-23) exists in LibreBooking's ManageEmailTemplatesPresenter.php. The 'save' action for email templates fails to validate the template name, allowing it to be used directly in a file path construction. An attacker with administrative privileges can provide a crafted template name containing traversal sequences (e.g., '../') to write files to arbitrary locations on the server, such as the web root. This can be leveraged to upload a PHP shell and achieve remote code execution (RCE). The issue was addressed by centralizing template name validation in a shared helper that enforces allowed extensions and rejects directory separators.

Affected products

  • LibreBooking LibreBooking < 5.1.0

Timeline

  • 2026-06-07: patched: Fixed in version 5.1.0 via pull request #1456
  • 2026-07-09: disclosed: CVE-2026-61343 published

References