CVE-2026-105037: CWE-73 External Control of File Name or Path in EnergizeLab station-middleware

CVE-2026-105037 is a critical vulnerability in EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2. It involves external control of file name or path (CWE-73), enabling any registered user with low privileges to read arbitrary files on the server by providing an attacker-controlled file path. This flaw exposes sensitive middleware files and server secrets, posing a severe risk to system security. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with a low-privilege registered account can read arbitrary files on the server, potentially exposing sensitive middleware files and server secrets. This compromises confidentiality and may also impact integrity and availability of the system. The vulnerability is critical due to the ease of exploitation and the high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict access to registered accounts and monitor for suspicious file access patterns related to this vulnerability.