CVE-2026-2753 PUBLISHED

Assigner: MHV
Reserved: 19.02.2026 Published: 06.03.2026 Updated: 06.03.2026

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Product Status

Vendor Navtor
Product NavBox
Versions Default: unaffected
  • Version 4.12.0.3 is affected
  • Version 4.16.2.4 is unaffected

Credits

  • Cydome Security Ltd finder

References

Problem Types

  • CWE-36 Absolute Path Traversal CWE

Impacts

  • Information Disclosure