{"id":"CVE-2026-1186","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1186","generatedAt":"2026-10-28T02:19:16.366Z","title":"EAP Legislator is vulnerable to Path Traversal in file extraction functionality.","description":"EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (default file type used by the Legislator application) and choose arbitrary path outside the intended directory (e.x. system startup) where files will be extracted by the victim upon opening the file.\nThis issue was fixed in version 2.25a.","published":"2026-02-02T14:16:34.000Z","lastModified":"2026-06-17T10:15:18.000Z","status":"Deferred","sourceIdentifier":"cvd@cert.pl","cvss":{"version":"4.0","score":8.6,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.004,"percentile":0.34004,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://abcpro.pl/eap-legislator","source":"cvd@cert.pl"},{"url":"https://cert.pl/posts/2026/02/CVE-2026-1186","source":"cvd@cert.pl"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1186","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}