CVE-2026-57871 - Vulnerability Details - OpenCVE

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microrealestate	Microrealestate

No data.

No data.

References

Link	Providers
https://github.com/microrealestate/microrealestate
https://www.themissinglink.com.au/security-advisories/cve-2026-57871

History

Fri, 10 Jul 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microrealestate Microrealestate microrealestate
Vendors & Products		Microrealestate Microrealestate microrealestate

Wed, 08 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title	Relative Path Traversal in MicroRealEstate File Upload Allows Overwrite of System Files

Tue, 07 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Title		Relative Path Traversal in MicroRealEstate File Upload Allows Overwrite of System Files

Tue, 07 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 07 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Weaknesses		CWE-23
References		https://github.com/microrealestate/microrealestate https://www.themissinglink.com.au/security-advisories/cve-2026-57871
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TML

Published: 2026-07-07T05:34:07.508Z

Updated: 2026-07-07T13:33:51.133Z

Reserved: 2026-06-26T00:40:34.057Z

Link: CVE-2026-57871

Vulnrichment

Updated: 2026-07-07T13:33:47.441Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57871", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "state": "PUBLISHED", "assignerShortName": "TML", "dateReserved": "2026-06-26T00:40:34.057Z", "datePublished": "2026-07-07T05:34:07.508Z", "dateUpdated": "2026-07-07T13:33:51.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-07T05:34:07.508Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "affected": [{"vendor": "MicroRealEstate", "product": "MicroRealEstate", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.0.0-alpha3", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.<p>This issue affects MicroRealEstate: through 1.0.0-alpha3.</p>"}]}], "references": [{"url": "https://github.com/microrealestate/microrealestate", "tags": ["product"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57871", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Jake Cleland", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T13:33:34.529387Z", "id": "CVE-2026-57871", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:33:51.133Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57871", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T13:33:34.529387Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:33:47.441Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jake Cleland"}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MicroRealEstate", "product": "MicroRealEstate", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.0-alpha3"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/microrealestate/microrealestate", "tags": ["product"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57871", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.", "supportingMedia": [{"type": "text/html", "value": "Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.<p>This issue affects MicroRealEstate: through 1.0.0-alpha3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal"}]}], "providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-07T05:34:07.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57871", "state": "PUBLISHED", "dateUpdated": "2026-07-07T13:33:51.133Z", "dateReserved": "2026-06-26T00:40:34.057Z", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "datePublished": "2026-07-07T05:34:07.508Z", "assignerShortName": "TML"}, "dataVersion": "5.2"}