CVE-2026-11944 is a CWE-22 path traversal vulnerability in openSIS Classic 9.3. It exists in the legacy messaging sent-mail attachment download functionality, permitting an authenticated attacker to read arbitrary files on the server by using crafted path traversal sequences. The vulnerability requires authentication but does not require user interaction and has a low attack complexity. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required beyond authentication, no user interaction, and low impact on confidentiality. No official fix or patch has been published yet.

An authenticated attacker can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information stored on the system. The impact is limited to confidentiality as per the CVSS vector. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to file access. Avoid using the legacy messaging sent-mail attachment download feature if possible.