CVE-2026-50186: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in RARgames 4gaBoards
CVE-2026-50186 is a path traversal vulnerability in RARgames 4gaBoards prior to version 3.3.8. An authenticated project manager can manipulate the filename parameter in a GET request to access arbitrary files on the server. This occurs because the application fails to properly validate and contain the pathname, allowing traversal sequences like '../'. Additionally, the vulnerable code deletes the accessed file, potentially causing data loss or denial of service. The issue is fixed in version 3.3.8.
AI Analysis
Technical Summary
4gaBoards versions before 3.3.8 contain a path traversal vulnerability (CWE-22) in the endpoint GET /exports/:id/:filename. The filename parameter is decoded and passed to path.join() under private/exports/<user_id>/ without containment validation, enabling an authenticated project manager to traverse directories and read arbitrary files accessible by the server process. Furthermore, the fileStream close handler calls fs.unlink() on the same path, deleting the file and causing potential data loss or denial of service. This vulnerability has a CVSS 3.1 score of 8.8, indicating high severity. The vulnerability is fixed in version 3.3.8.
Potential Impact
An authenticated project manager can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. Additionally, the vulnerability allows deletion of arbitrary files accessible by the server process, leading to data loss or denial of service conditions.
Mitigation Recommendations
This vulnerability is fixed in 4gaBoards version 3.3.8. Users should upgrade to version 3.3.8 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, restrict project manager privileges and monitor file access closely.
CVE-2026-50186: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in RARgames 4gaBoards
Description
CVE-2026-50186 is a path traversal vulnerability in RARgames 4gaBoards prior to version 3.3.8. An authenticated project manager can manipulate the filename parameter in a GET request to access arbitrary files on the server. This occurs because the application fails to properly validate and contain the pathname, allowing traversal sequences like '../'. Additionally, the vulnerable code deletes the accessed file, potentially causing data loss or denial of service. The issue is fixed in version 3.3.8.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/rargames/4gaBoardsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
4gaBoards versions before 3.3.8 contain a path traversal vulnerability (CWE-22) in the endpoint GET /exports/:id/:filename. The filename parameter is decoded and passed to path.join() under private/exports/<user_id>/ without containment validation, enabling an authenticated project manager to traverse directories and read arbitrary files accessible by the server process. Furthermore, the fileStream close handler calls fs.unlink() on the same path, deleting the file and causing potential data loss or denial of service. This vulnerability has a CVSS 3.1 score of 8.8, indicating high severity. The vulnerability is fixed in version 3.3.8.
Potential Impact
An authenticated project manager can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. Additionally, the vulnerability allows deletion of arbitrary files accessible by the server process, leading to data loss or denial of service conditions.
Mitigation Recommendations
This vulnerability is fixed in 4gaBoards version 3.3.8. Users should upgrade to version 3.3.8 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, restrict project manager privileges and monitor file access closely.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-03T22:05:13.645Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a84d389c6e8be0332cafc85
Added to database: 08/18/2026, 21:50:01 UTC
Last enriched: 08/18/2026, 22:05:06 UTC
Last updated: 08/19/2026, 01:56:15 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.