| TVN ID | TVN-202609008 |
|---|---|
| CVE ID | CVE-2026-93467, CVE-2026-93468 |
| CVSS | 【CVE-2026-93467】 9.3 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-93468】 8.7 (High) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Affected Products | 【CVE-2026-93467】 OAKlouds-custom_page-2.0 version before 26 OAKlouds-custom_page-3.0 version before 26 OAKlouds-custom_page-4.0 version before 26 【CVE-2026-93468】 OAKlouds-bulletin_v3-2.0 version before 107 OAKlouds-bulletin_v3-3.0 version before 107 |
| Description | 【CVE-2026-93467(Insecure Deserialization)】 Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. 【CVE-2026-93468(Arbitrary File Read)】 Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files. |
| Solution | 【CVE-2026-93467】 Update OAKlouds-custom_page-2.0 version 26 or later Update OAKlouds-custom_page-3.0 version 26 or later Update OAKlouds-custom_page-4.0 version 26 or later 【CVE-2026-93468】 Update OAKlouds-bulletin_v3-2.0 version 107 or later Update OAKlouds-bulletin_v3-3.0 version 107 or later |
| Credit | Linwz(DEVCORE) |
| Public Date | 2026-09-18 |
:::