PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8736 Oinone CVE debrief

CVE-2026-8736 is reported as a path traversal issue in Oinone Pamirs up to version 7.2.0. The flaw is described in LocalFileClient.java within the RestController component, where manipulation of the uniqueFileName argument can lead to traversal outside the intended path. The source record also says a public exploit was released, and NVD assigns a low-severity CVSS 4.0 vector with physical access and low privileges.

Vendor
Oinone
Product
Pamirs
CVSS
LOW 0.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-17
Original CVE updated
2026-05-18
Advisory published
2026-05-17
Advisory updated
2026-05-18

Who should care

Administrators, operators, and developers responsible for Oinone Pamirs deployments should review this CVE, especially if the affected file-handling component is enabled or if local/physical access to hosts is realistic.

Technical summary

The supplied record maps this issue to CWE-22 (path traversal). NVD’s CVSS 4.0 vector describes a physical-access scenario with low privileges and no user interaction, and the source description ties the issue to request.getParameter handling of uniqueFileName in LocalFileClient.java under the RestController component. The affected version range in the source description is Oinone Pamirs through 7.2.0.

Defensive priority

Low severity in the supplied scoring, but it should be reviewed promptly in any deployment that exposes the affected file-handling path or where local/physical access is plausible. The public-exploit claim increases the need to validate exposure and apply mitigations quickly if the product is in use.

Recommended defensive actions

  • Confirm whether Oinone Pamirs version 7.2.0 or earlier is deployed and whether the RestController/LocalFileClient path is reachable.
  • Inspect any code or configuration that uses uniqueFileName from request parameters and add strict allowlist plus canonical-path validation.
  • Apply a vendor fix or upgrade as soon as an affected version is available; if no patch is available, disable or restrict the affected functionality.
  • Restrict local and physical access to systems running the product and limit who can invoke the affected component.
  • Review logs and file-access telemetry for unusual path traversal attempts or unauthorized reads and writes.

Evidence notes

The debrief is based only on the supplied NVD record snapshot and the VulDB-linked references included in that record. The source data states: affected product Oinone Pamirs up to 7.2.0; component LocalFileClient.java in RestController; manipulation of uniqueFileName leads to path traversal; CWE-22; and a public exploit claim. NVD’s supplied CVSS 4.0 vector is CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The vendor-response statement is source-reported and not independently validated here.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8736 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8736

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8736 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8736

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.