CVE-2026-108158: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in mynaparrot plugNmeet-server

CVE-2026-108158 is a path traversal vulnerability in plugNmeet Server through version 2.5.2. The vulnerability exists in the whiteboard conversion endpoint, where insufficient validation of the filePath parameter allows an attacker to traverse directories and access arbitrary files on the server. By exploiting this, an attacker can convert arbitrary text or office documents into images and download them unauthenticated, potentially exposing sensitive server files to any meeting participant.

An attacker who is a participant in a meeting can read arbitrary files on the server without authentication. This could lead to unauthorized disclosure of sensitive information stored on the server. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating significant risk due to network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict meeting participant access and monitor for suspicious activity related to file downloads from the /download/uploadedFile/ endpoint. Avoid exposing sensitive files on the server that could be accessed via path traversal.