Medium severity · published Jul 14, 2026
CVE-2026-49488
Apache OpenMeetings: Arbitrary File Read
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.
This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0.
An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Apache OpenMeetings · Apache Software Foundation
5.0.0 before 9.1.0 · source: vendor
OP
Openmeetings · Apache
5.0.0 before 9.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49488
Mailing List
https://lists.apache.org/thread/74zf32shox9oy62b7t55mvcj874bxqnj
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/14/10
More from Apache OpenMeetings
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
7.5
CVE-2026-33266
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
7.5
CVE-2026-34020
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
4.3
CVE-2026-33005
Apache OpenMeetings: Insufficient checks in FileWebService