CVE-2026-36723: n/a
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).
AI Analysis
Technical Summary
This vulnerability exists in the /api/create-user endpoint of bookcars v8.3, where insufficient validation allows authenticated users to perform directory traversal during file rename operations. Attackers can relocate files from temporary storage to arbitrary server paths, potentially accessing sensitive data, corrupting application files, or executing code remotely. No CVSS score or official remediation information is currently available.
Potential Impact
Exploitation can result in unauthorized disclosure of sensitive information, modification or overwriting of critical application files, and remote code execution on the affected server. This poses a significant risk to the confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/create-user endpoint to trusted users only and monitor for suspicious activity related to file operations.
CVE-2026-36723: n/a
Description
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the /api/create-user endpoint of bookcars v8.3, where insufficient validation allows authenticated users to perform directory traversal during file rename operations. Attackers can relocate files from temporary storage to arbitrary server paths, potentially accessing sensitive data, corrupting application files, or executing code remotely. No CVSS score or official remediation information is currently available.
Potential Impact
Exploitation can result in unauthorized disclosure of sensitive information, modification or overwriting of critical application files, and remote code execution on the affected server. This poses a significant risk to the confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/create-user endpoint to trusted users only and monitor for suspicious activity related to file operations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-06T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2923fb8dd33fbd85129103
Added to database: 6/10/2026, 8:44:43 AM
Last enriched: 6/10/2026, 8:52:36 AM
Last updated: 6/10/2026, 2:57:37 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.