CVE-2026-49488 — Apache OpenMeetings: Arbitrary File Read

Description (CNA)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request. Users are recommended to upgrade to version 9.1.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache OpenMeetings	affected 5.0.0 before 9.1.0

CWE

CWE-22

References

https://lists.apache.org/thread/74zf32shox9oy62b7t55mvcj874bxqnj

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/07/14/10

CISA-ADP

No English description supplied.

No references supplied.