Threats affecting pkg:maven/oinone/pamirs

CVE-2026-8736 is a path traversal vulnerability in Oinone Pamirs versions up to 7.2.0. It affects the request.getParameter function in the LocalFileClient.java file within the RestController component. Manipulating the uniqueFileName argument can lead to path traversal on the physical device. The vulnerability has a low CVSS score of 2.4 and the vendor has not responded to the disclosure. No official patch or remediation guidance is currently available.

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.