The MicroRealEstate application versions through 1.0.0-alpha3 contain a relative path traversal vulnerability (CWE-23) in its file upload feature. This flaw enables an attacker with limited privileges to craft file upload requests that traverse directories and overwrite arbitrary system files. The vulnerability has been assigned CVE-2026-57871 and is rated high severity based on CVSS version 4.0 metrics. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation could allow an attacker to overwrite critical system files, potentially leading to system compromise or denial of service. The vulnerability requires no user interaction and has low attack complexity, increasing the risk. However, exploitation requires at least limited privileges (PR:L). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and validate file paths rigorously to mitigate exploitation risk.