CVE-2026-70383: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Estonian Information System Authority (RIA) DigiDoc4

CVE-2026-70383 describes a CWE-22 path traversal vulnerability in the DigiDoc4 client software by the Estonian Information System Authority (RIA). This vulnerability affects versions >=4.0.0 and <4.11.0. It involves improper limitation of pathnames to restricted directories, which could allow an attacker to access files outside intended directories. The CVSS 4.0 score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability could allow an attacker with local access and user interaction to traverse directories and access or manipulate files outside the intended restricted directory. This could lead to unauthorized disclosure, modification, or deletion of sensitive files, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply any official patches once available.