CVE-2026-116255 PGYER CVE debrief

Who should care

Defenders responsible for PGYER codefever deployments should assess exposure and apply the patch to prevent potential path traversal attacks. They should also review and update the product to the latest version, monitor the product for any suspicious activity, and verify patch application to prevent path traversal.

Why it matters

CVE-2026-116255 is a path traversal vulnerability in PGYER codefever that can be exploited remotely. Defenders should apply the patch and assess exposure to prevent potential attacks.

• Verify patch application to prevent path traversal
• Assess exposure of PGYER codefever deployments
• Monitor for suspicious activity related to the vulnerability

Technical summary

The _detail function in application/controllers/doc.php of PGYER codefever is vulnerable to path traversal. The manipulation of the uri_string argument can lead to unauthorized access to files on the system. The vulnerability has a CVSS score of 5.5 and is considered medium severity. The vulnerability was found in PGYER codefever up to commit 0c35e60f006f9d558cc33a159baf110659351990. The issue is triggered by manipulating the uri_string argument. This vulnerability can be exploited remotely. A patch (e4433eee96883a222403854e8ac38b3146774a07) is available to fix this issue.

Defensive priority

Apply the patch (e4433eee96883a222403854e8ac38b3146774a07) to fix the path traversal vulnerability in PGYER codefever.

Recommended defensive actions

• Apply the patch (e4433eee96883a222403854e8ac38b3146774a07) to fix the path traversal vulnerability in PGYER codefever
• Review and update the product to the latest version
• Monitor the product for any suspicious activity
• Verify patch application to prevent path traversal
• Assess exposure of PGYER codefever deployments
• Monitor for suspicious activity related to the vulnerability
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and references to the affected product and patch. The vulnerability was found in PGYER codefever up to commit 0c35e60f006f9d558cc33a159baf110659351990. The affected function is _detail in application/controllers/doc.php. The issue is triggered by manipulating the uri_string argument. This vulnerability can be exploited remotely. A patch (e4433eee96883a222403854e8ac38b3146774a07) is available to fix this issue. The product uses

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.