Read the docs
TI-2026-30019 Aliases CVE-2026-41419

4ga Boards: Import Path Traversal Leads to Arbitrary File Read

Priority HIGH 66CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive import. Once imported, the file can be downloaded through the normal application interface, resulting in unauthorized local file disclosure. This vulnerability is fixed in 3.3.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed 4gaBoards (RARgames): 3.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RARgames4gaBoardsbefore 3.3.53.3.5Patch availableCNA
  • 4gaBoards VendorRARgames Affected before 3.3.5 Fixed in 3.3.5 Patch available CNA

Remediation

  • Fix · CNA 4gaBoards (RARgames) Fixed in 3.3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41419

References

Other 1

  • TI-2026-36945 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export CVSS 3.1HIGH 8.8
  • TI-2026-38925 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment CVSS 3.1HIGH 7.6
  • TI-2026-38926 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user CVSS 3.1MEDIUM 6.5
  • TI-2026-36950 4gaBoards: Pre-Account Takeover via SSO Email Linkage CVSS 3.1HIGH 8.8
  • TI-2026-30018 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences