Read the docs
TI-2026-47682 Aliases CVE-2026-67395GHSA-pg5x-hjq6-v5p3

Path traversal in Sage Employee Self Service

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the application's intended file system scope. Successful exploitation would require knowledge of valid file names and paths. Depending on the privileges of the affected component, exploitation could result in the disclosure of sensitive information, including configuration files, environment settings, application assets, and log data. The vulnerability has been remediated through enhanced path validation and secure path resolution controls that prevent access to unauthorised locations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01099 65th percentileScored 2026-11-07
Fix Fixed Employee Self Service (Sage): Q2 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SageEmployee Self ServiceQ2 2026 to before Q2 2026Q2 2026Patch availableCNA
  • Employee Self Service VendorSage Affected Q2 2026 to before Q2 2026 Fixed in Q2 2026 Patch available CNA

Remediation

  • Fix · CNA Employee Self Service (Sage) Fixed in Q2 2026

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67395
  2. 2026-10-03 Alias added: GHSA-pg5x-hjq6-v5p3

References

Other 1

  • TI-2020-05970 Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing CVSS 3.1CRITICAL 10.0
  • TI-2022-15233 Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow… CVSS 3.1CRITICAL 9.0
  • TI-2022-15235 Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated… CVSS 3.1HIGH 8.8
  • TI-2019-15193 A path traversal vulnerability exists in Sage FRP 1000 before November 2019. CVSS 3.1HIGH 7.5
  • TI-2022-18156 On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows… CVSS 3.1HIGH 7.8
  • TI-2022-15234 Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an… CVSS 3.1MEDIUM 5.4
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences