ikus-soft CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ikus-soft CVE published 2026-10-16

CVE-2026-109119

CVE-2026-109119 Improper Privilege Management in Rdiffweb allows authenticated users to elevate privileges to administrator by modifying the role parameter in a POST request to the user management API endpoint. This vulnerability has a high CVSS score of 8.8, indicating a significant risk to affected systems. Defenders should assess exposure and verify current role parameter handling to prevent potential [truncated]

MEDIUM ikus-soft CVE published 2026-10-16

CVE-2026-109118

CVE-2026-109118 is a medium-severity vulnerability in rdiffweb 7.1.1 that allows an authenticated user to perform operations outside the intended repository by exploiting a flawed path containment check. The issue arises from the use of a string prefix comparison instead of a proper filesystem path boundary check, enabling an attacker to manipulate paths using percent-encoded traversal sequences.