Read the docs
TI-2026-67660 Aliases CVE-2026-104810GHSA-w6gr-fq2r-hcjh

Path traversal in Mitel MiVoice Office 400 lets attackers delete files

Priority LOW 39CWE-31Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Mitel MiVoice Office 400 versions from 11.0.96.0 are affected. A path traversal flaw (CWE-31) in the web portal's File Browser lets an authenticated attacker reach files outside the intended directory. A remote attacker with valid credentials can delete sensitive Mitel application and Linux system files, which can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MitelMitel MiVoice Office 40011.0.96.0—No fix listedCNA
  • Mitel MiVoice Office 400 VendorMitel Affected 11.0.96.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Mitel MiVoice Office 400.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104810
  2. 2026-10-05 Alias added: GHSA-w6gr-fq2r-hcjh

References

Other 1

  • TI-2022-11960 The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09601 The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-27773 A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab… KEVCVSS 3.1CRITICAL 9.1
  • TI-2024-27770 A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones… KEVCVSS 3.1HIGH 7.2
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19733 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could… KEVCVSS 3.1MEDIUM 6.8
See all 141 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences