CVE-2026-111833: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Bold Grid weForms

The vulnerability identified as CVE-2026-111833 in Bold Grid weForms is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal issue. It affects weForms versions from the initial release up to 1.6.28. This vulnerability enables an attacker to traverse directories beyond the intended scope, potentially causing denial of service or other availability impacts. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can be exploited remotely without authentication or user interaction, leading to a high impact on the availability of the affected system. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to path traversal attempts.