Medium severity · published Oct 5, 2026
CVE-2026-104806
Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.
The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure.
By exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Mitel MiVoice Office 400 · Mitel
11.0.96.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104806
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104806
digitalcanion.com
https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna
More from Mitel MiVoice Office 400
8.5
CVE-2026-104805
Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution
8.4
CVE-2026-104811
Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution
8.4
CVE-2026-104810
Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability
8.4
CVE-2026-104809
Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution
8.4
CVE-2026-104706
Mitel MiVoice Office 400 view system files path traversal
