CVE-2026-67395: CWE-22 Path Traversal in Sage Employee Self Service

This vulnerability involves improper validation of file path parameters in the custom logo functionality of Sage Employee Self Service. By leveraging directory traversal sequences and their encoded variants, an attacker can bypass directory restrictions and access files outside the application's intended file system scope. Successful exploitation could disclose sensitive information including configuration files, environment settings, application assets, and log data. The vendor has remediated the issue by enhancing path validation and implementing secure path resolution controls to prevent unauthorized file access.

An attacker exploiting this vulnerability could gain unauthorized read access to sensitive files outside the intended directory scope of the application. This may lead to disclosure of sensitive information such as configuration files, environment settings, application assets, and log data. The vulnerability does not allow modification or denial of service, but the confidentiality impact is high.

The vulnerability has been remediated by Sage through enhanced path validation and secure path resolution controls. No specific patch version or update details are provided. Users should consult Sage's official advisories or support channels for the latest updates and apply any available fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.