CVE-2026-62278
highLubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker.
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name could therefore move an uploaded file outside the intended storage directory, enabling unauthorized file placement or overwrite with the privileges of the application process. This issue is fixed in version 1.6.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57 security-advisories@github.com
- https://github.com/hargata/lubelog/issues/1398 security-advisories@github.com
- https://github.com/hargata/lubelog/pull/1395 security-advisories@github.com
- https://github.com/hargata/lubelog/releases/tag/v1.6.8 security-advisories@github.com
- https://github.com/hargata/lubelog/security/advisories/GHSA-qm5x-mmwx-q7rm security-advisories@github.com