Is CVE-2026-92970 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92970 being exploited in the wild.

How severe is CVE-2026-92970?

High severity, with a CVSS score of 8.8, published 17 September 2026.

Is there a fix for CVE-2026-92970?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92970 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92970?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92970: HUBzero CMS path traversal in project file upload

CVE-2026-92970 · Severity: high · CVSS 8.8 · Published 2026-09-17

HUBzero CMS is an open-source collaboration platform used by research institutions and scientific communities. A path traversal vulnerability in its file upload handler allows authenticated project members to write arbitrary files outside the intended project directory with web server privileges, potentially leading to remote code execution and full system compromise.

Quick answers

Is CVE-2026-92970 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92970 being exploited in the wild.
How severe is CVE-2026-92970?: High severity, with a CVSS score of 8.8, published 17 September 2026.
Which products and versions are affected?: HUBzero CMS through 2.2.32.
Is there a fix for CVE-2026-92970?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92970 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92970?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the project file upload handlers (filesv1_0.php controller) and is caused by insufficient path sanitization in the upload parameter processing. An authenticated project member can supply traversal sequences (e.g., "../../../") to write files to arbitrary locations on the server. The vulnerability requires prior authentication and project member access, but no additional user interaction. An attacker can achieve remote code execution by uploading a PHP shell or other executable files to web-accessible directories, gaining execution with the web server's privileges. The issue affects HUBzero CMS through version 2.2.32.

Affected products

HUBzero CMS through 2.2.32

Timeline

2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.