Threats affecting pkg:maven/pmweb/pmweb

CVE-2026-101082 is a path traversal vulnerability in PMWeb affecting versions 7.x, 8.x, and 2025.x. The issue involves improper handling of the FullFileName/FileName argument in the file downloader.aspx component, allowing remote attackers to manipulate file paths. Exploit code is publicly available. The vendor has not responded to disclosure requests, and no patch or remediation guidance is currently known. The vulnerability has a medium severity rating with a CVSS score of 6.9.