Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory… (CVE-2026-111635)

CVE-2026-111635 describes a path traversal vulnerability in Helical Insight through version 7.0.0. Authenticated viewers can exploit the /getExternalResource endpoint by supplying parent-directory traversal sequences in the path parameter to read files outside the solution directory. The vulnerability allows reading any readable file with allowed extensions such as js, json, or html, bypassing per-resource access control mechanisms. This flaw is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

An authenticated user can read files outside the designated solution directory, potentially exposing sensitive configuration or code files with extensions like js, json, or html. The impact is limited to information disclosure (confidentiality) with no integrity or availability impact reported. The CVSS score is 4.3 (medium severity), reflecting the need for authentication and limited impact scope.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted users only and monitor usage of the /getExternalResource endpoint for suspicious activity.