Read the docs
TI-2026-36945 Aliases CVE-2026-50186

4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is passed to path.join() beneath private/exports/<user_id>/ without containment validation. A crafted value such as ../ can select an arbitrary file readable by the server process, and the file is returned to the attacker. The fileStream close handler then passes the same path to fs.unlink(), deleting the selected file and potentially causing data loss or denial of service. This issue is fixed in version 3.3.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00586 48th percentileScored 2026-11-07
Fix Fixed 4gaBoards (RARgames): 3.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RARgames4gaBoardsbefore 3.3.83.3.8Patch availableCNA
  • 4gaBoards VendorRARgames Affected before 3.3.8 Fixed in 3.3.8 Patch available CNA

Remediation

  • Fix · CNA 4gaBoards (RARgames) Fixed in 3.3.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50186

References

Other 3

  • TI-2026-38925 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment CVSS 3.1HIGH 7.6
  • TI-2026-30019 4ga Boards: Import Path Traversal Leads to Arbitrary File Read CVSS 3.1HIGH 7.6
  • TI-2026-38926 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user CVSS 3.1MEDIUM 6.5
  • TI-2026-36950 4gaBoards: Pre-Account Takeover via SSO Email Linkage CVSS 3.1HIGH 8.8
  • TI-2026-30018 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences