Medium severity · published Mar 24, 2026
CVE-2026-21783
HCL Traveler is affected by sensitive information disclosure
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Traveler is affected by sensitive information disclosure.  The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.  Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Traveler · HCLSoftware
< 14.5.1.0 · source: vendor, NVD
Affected product
TR
Traveler
HCLSoftware
More from Traveler
6.3
CVE-2026-21790
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability
3.5
CVE-2026-56547
An input reflection vulnerability affects HCL Traveler