CVE-2026-14194 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in HUMANIST Digital Human Resources version 26.0. This vulnerability allows an attacker with low privileges and no user interaction to access files outside the intended directory scope, potentially leading to unauthorized disclosure of sensitive information. The vulnerability affects exactly version 26.0 and is fixed in later versions starting from 26.1. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

An attacker with low privileges can exploit this vulnerability to read files outside the intended directory, potentially exposing sensitive information. The vulnerability does not allow modification or denial of service. The impact is confidentiality loss only, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Restricting user privileges and limiting access to the affected system may reduce risk until a patch is available.