TVN ID	TVN-202601008
CVE ID	CVE-2026-1330, CVE-2026-1331, CVE-2026-1332
CVSS	CVE-2026-1330： 7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-1331： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-1332： 5.3 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products	MeetingHub(with attendance module installed)
Description	CVE-2026-1330： MeetingHub has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files. CVE-2026-1331： MeetingHub has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. CVE-2026-1332： MeetingHub has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.
Solution	Install the patch with version 20251210 or later.
Credit	Alan Chung(DEVCORE)
Public Date	2026-01-22