{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30996", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-15T18:05:30.972Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-15T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-15T16:33:45.120Z"}, "descriptions": [{"lang": "en", "value": "An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/softsul-path-transversal"}, {"url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30996"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T18:05:00.547653Z", "id": "CVE-2026-30996", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:05:30.972Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30996", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:05:00.547653Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:05:27.061Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/softsul-path-transversal"}, {"url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30996"}], "descriptions": [{"lang": "en", "value": "An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-15T16:33:45.120Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30996", "state": "PUBLISHED", "dateUpdated": "2026-04-15T18:05:30.972Z", "dateReserved": "2026-03-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-15T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request."}], "id": "CVE-2026-30996", "lastModified": "2026-04-27T19:18:46.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-15T17:17:04.443", "references": [{"source": "cve@mitre.org", "url": "https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30996"}, {"source": "cve@mitre.org", "url": "https://cve.joaopaulodeoliveira.dev/cve.php/reserved/softsul-path-transversal"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.02"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "sac-nfe", "vendor": "softsul"}], "analysis": {"en": {"generated_at": "2026-04-15T19:29:20.351300+00:00", "value": {"mitigation_remediation": ["Apply any available vendor patch or upgrade to a fixed version of SAC\u2011NFe if one has been released.", "If a patch is unavailable, restrict network access to the download.php endpoint or place it behind authentication to limit exposure.", "Validate and sanitize the file path parameter server\u2011side, ensuring that the resolved path resides within a whitelisted directory and that any traversal characters are removed or neutralized.", "Remove or disable the download.php functionality if it is not required for system operation."], "summary": {"action": "Immediate Mitigation", "impact": "Confidentiality Breach"}, "threat_synthesis": {"affected_systems": "The affected product is SAC\u2011NFe, specifically version 2.0.02. No vendor information is provided in the public record, but stakeholders using this version should consider it vulnerable until a fix is available.", "description_and_impact": "An issue in the download.php component of SAC\u2011NFe v2.0.02 allows an attacker to craft a GET request that performs a directory traversal, leading to arbitrary file read. The flaw arises from insufficient validation of the requested file path. An attacker can read any file accessible to the web server process, exposing sensitive configuration, credentials, or code. This vulnerability is identified as a Path Traversal weakness (CWE\u201122).", "risk_and_exploitability": "No CVSS, EPSS, or KEV metrics are reported for this vulnerability. The attack vector is inferred to be remote via an HTTP GET request to the vulnerable endpoint. Exploitation requires network access to the web server hosting SAC\u2011NFe. Although there is no documented evidence of exploitation, the severity is significant because it permits an attacker to read any file the web server process can access, potentially leading to further compromise."}}}}, "created": "2026-04-15T19:30:12.405188+00:00", "title": "Directory Traversal in SAC\u2011NFe v2.0.02 download.php Allows Arbitrary File Read", "updated": "2026-04-16T09:12:52.575276+00:00", "vendors": ["softsul", "softsul$PRODUCT$sac-nfe"], "weaknesses": ["CWE-22", "CWE-200"]}