{"id":"CVE-2026-76806","aliases":["EUVD-2026-117055","GHSA-cj49-589g-wp6j"],"status":"published","title":"Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00251,"percentile":0.16744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-11-04T19:31:54Z","modified":"2026-11-05T10:46:24Z","products":[{"vendor":"solidtime-io","product":"solidtime"}],"references":[{"url":"https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76806.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76806","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-76806","title":"Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","status":"published","published":"2026-11-04T19:31:54.604Z","modified":"2026-11-09T17:00:09.078Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T17:34:05.709049Z"}],"euvd":[{"id":"EUVD-2026-117055","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","status":"published","published":"2026-11-04T19:31:54Z","modified":"2026-11-09T17:00:09Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-09T18:17:39.592818Z"}],"nvd":[{"id":"CVE-2026-76806","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","status":"published","published":"2026-11-04T20:19:12.81Z","modified":"2026-11-09T17:17:32.953Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T20:15:34.048597Z"}],"osv":[{"id":"CVE-2026-76806","title":"Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle","description":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.","status":"published","published":"2026-11-04T19:31:54.604Z","modified":"2026-11-11T02:30:24.58612577Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-10T02:45:56.338826Z"}]}}