CVE-2026-11944: Os4ed Opensis Path Traversal Flaw

CVE-2026-11944 Overview

CVE-2026-11944 is an authenticated path traversal vulnerability in openSIS Classic 9.3, an open-source student information system developed by OS4ED. The flaw resides in the legacy messaging sent-mail attachment download functionality. An authenticated attacker can supply crafted path traversal sequences to read arbitrary files from the underlying server. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and affects deployments on Windows, Linux, and macOS hosts. Successful exploitation exposes configuration files, database credentials, and application source code accessible to the web server process.

Critical Impact
Authenticated attackers can read arbitrary files on the openSIS Classic 9.3 server, including sensitive configuration files and credentials, through crafted attachment download requests.

Affected Products

OS4ED openSIS Classic 9.3 (community edition)
Deployments on Microsoft Windows hosts
Deployments on Linux and Apple macOS hosts

Discovery Timeline

2026-07-14 - CVE-2026-11944 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-11944

Vulnerability Analysis

The vulnerability resides in the legacy messaging module of openSIS Classic 9.3, specifically in the sent-mail attachment download handler. The handler accepts a user-controlled filename parameter and passes it to file system read operations without validating or canonicalizing the path. An authenticated user can inject ../ sequences to escape the intended attachment directory. This allows the attacker to reference any file readable by the web server user. Because openSIS stores database credentials in PHP configuration files within the application root, credential disclosure is a realistic outcome. The issue requires only a low-privilege authenticated session, expanding the reachable attacker population to any registered user, including students and staff.

Root Cause

The root cause is missing input validation on the attachment filename parameter. The application concatenates the user-supplied value with a base directory and opens the resulting path directly. There is no allowlist check, no realpath normalization, and no confinement to the attachments directory. This is a textbook [CWE-22] failure. The full technical description is available in the Fluid Attacks Security Advisory.

Attack Vector

Exploitation occurs over the network against the openSIS web application. The attacker must first authenticate with any valid user account. After logging in, the attacker issues a request to the sent-mail attachment download endpoint and substitutes the attachment filename with a traversal payload such as ../../../../etc/passwd or ../../database.inc.php. The server responds with the raw contents of the referenced file. Source code for the vulnerable component is public in the GitHub Repository for openSIS-Classic.

Detection Methods for CVE-2026-11944

Indicators of Compromise

HTTP requests to openSIS messaging attachment download endpoints containing ../, ..\\, or URL-encoded variants such as %2e%2e%2f.
Web server access logs showing attachment download requests referencing filenames outside the configured attachments directory.
Unexpected reads of config.inc.php, /etc/passwd, or other sensitive files by the PHP process account.

Detection Strategies

Deploy web application firewall signatures that flag path traversal patterns on openSIS message and attachment URLs.
Correlate authenticated session activity with abnormal file access patterns from the PHP interpreter on the openSIS host.
Review audit logs for low-privilege accounts accessing the sent-mail module at unusual volumes.

Monitoring Recommendations

Enable verbose access logging on the web server hosting openSIS and forward logs to a centralized SIEM for path traversal pattern matching.
Alert on any process spawned by the web server reading files outside the application document root or attachment directory.
Track authentication events and pair them with subsequent attachment download activity to identify credential misuse.

How to Mitigate CVE-2026-11944

Immediate Actions Required

Restrict access to the openSIS application to trusted networks or place it behind a VPN until a fixed release is deployed.
Audit user accounts and disable inactive or unnecessary accounts to reduce the authenticated attack surface.
Rotate database credentials and any secrets stored in files readable by the web server if exploitation is suspected.

Patch Information

At the time of publication, no vendor advisory or fixed release has been referenced in the NVD entry. Monitor the GitHub Repository for openSIS-Classic for updates and apply upstream fixes as soon as they become available. Review the Fluid Attacks Security Advisory for additional remediation guidance.

Workarounds

Disable the legacy messaging module in openSIS if it is not required for operations.
Add a web server rewrite rule that rejects requests to attachment download endpoints containing .. or encoded traversal sequences.
Run the openSIS PHP process under a dedicated low-privilege account with file system permissions limited to the application directory.

bash

# Example Apache rule to block path traversal on attachment endpoints
<LocationMatch "/Modules/Messaging/.*\.(php)$">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/) [NC]
    RewriteRule .* - [F,L]
</LocationMatch>