CVE-2026-40526: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Volmarg personal-management-system

CVE-2026-40526 is a path traversal vulnerability in Volmarg Personal Management System that allows authenticated users to read arbitrary files by providing absolute filesystem paths to the GET /public/get-file/{path} endpoint. The application passes the path parameter directly to PHP's file_get_contents() function without canonicalizing or restricting it to a permitted base directory. This lack of validation enables attackers to access sensitive files accessible to the PHP-FPM worker process without needing directory traversal sequences. The vulnerability affects versions from 0 up to and including 2.0.4.

An authenticated attacker can read arbitrary files on the server that are accessible to the PHP-FPM process. This can lead to disclosure of sensitive information stored on the server, potentially compromising confidentiality. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity. Avoid exposing sensitive files to the PHP-FPM worker process and consider implementing input validation or canonicalization on the path parameter to restrict file access to a safe directory.