CVE-2026-77139 — Path Traversal in extension "Mask" (mask)
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend …
Published: 2026-08-25 · CVSS: 6.0 · CVSS 4.0
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7