openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download
Priority MEDIUM 57CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OS4ED | openSIS-Classic | 9.3 | — | No fix listed | CNA |
- openSIS-Classic VendorOS4ED Affected 9.3 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:os4ed:opensis:9.3:*:*:*:community:*:*:* | 9.3 | Vulnerable | OS4ED |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:os4ed:opensis:9.3:*:*:*:community:*:*:* Versions 9.3 Vulnerable ·OS4ED
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-11944
- 2026-10-03 Alias added: GHSA-5v7m-6h74-672r
References
More OS4ED Opensis vulnerabilities
- TI-2024-34282 SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in… CVSS 3.1CRITICAL 9.8
- TI-2020-10493 openSIS through 7.4 allows SQL Injection. CVSS 3.1CRITICAL 9.8
- TI-2025-16780 OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id… CVSS 3.1HIGH 8.8
- TI-2025-16779 An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory… CVSS 3.1HIGH 8.8
- TI-2024-31069 OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload. CVSS 3.1HIGH 8.8
- TI-2024-23488 SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php… CVSS 3.1HIGH 8.8
Sources
- CVE-2026-11944 · CVE Program
- CVE-2026-11944 · NVD
- FIRST EPSS
- GHSA-5v7m-6h74-672r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences