CVE-2026-19054 is a path traversal vulnerability in Lspace-io lspace-server up to commit 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. It affects the fileExists, readFile, writeFile, and deleteFile functions in src/core/repository.ts within the Repositories File API component. The vulnerability arises from improper handling of the filePath argument, enabling path traversal attacks. Exploitation requires local access with low privileges and does not require user interaction. The product uses continuous delivery with rolling releases, so no explicit version numbers for affected or fixed releases are available. The project has been informed but has not yet responded or issued a fix.

Successful exploitation could allow an attacker with local access and low privileges to read, write, or delete files outside intended directories via path traversal. This could lead to limited confidentiality, integrity, and availability impacts on the affected system. However, the attack vector is local access only, reducing the overall risk. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious activity involving file operations. No official patch or workaround is currently available.