OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation.
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00428·Published 2026-10-22·Fixed in 5.2.5, 7.4.4CWE-22