CVE-2026-36453: Rhymix Path Traversal Vulnerability

CVE-2026-36453 Overview

CVE-2026-36453 is an insecure direct object reference (IDOR) vulnerability in Rhymix, an open-source content management system (CMS). The flaw affects all versions of Rhymix prior to 2.1.31 and is tracked internally by the project as RVE-2026-1. An authenticated attacker with low privileges can access arbitrary files by supplying crafted extra variables to the application. The weakness is classified under [CWE-425: Direct Request (Forced Browsing)].

Critical Impact
Attackers with low-privilege accounts can associate arbitrary files with content through manipulated extra variables, leading to unauthorized file access across the CMS.

Affected Products

Rhymix CMS versions prior to 2.1.31
Rhymix installations exposing authenticated write endpoints to untrusted users
Downstream sites and portals built on affected Rhymix releases

Discovery Timeline

2026-09-13 - CVE-2026-36453 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-36453

Vulnerability Analysis

Rhymix accepts additional request parameters, referred to as extra variables, when processing content submissions. The application uses these values to associate uploaded or referenced files with modules and documents. Before version 2.1.31, the code path failed to validate whether the supplied file reference belonged to the requesting user or to an authorized upload session. An attacker able to submit content through the CMS can substitute the file reference with an identifier pointing to any file record in the system. This enables unauthorized read access to files that should be restricted to their owners or to administrators.

Root Cause

The root cause is missing authorization on file identifiers passed as extra variables. The patch in commit f131a61 introduces a new filter error message, invalid_file, indicating that server-side validation now rejects values that are not legitimate uploaded files for the current request context. Prior to this fix, the application trusted client-supplied file references without confirming ownership or upload provenance.

Attack Vector

Exploitation requires network access to a Rhymix instance and a low-privileged authenticated account. The attacker submits a normal content or module operation and appends an extra variable that references a file identifier belonging to another user or restricted context. Because the server does not verify the reference, the file becomes associated with attacker-controlled content and can be retrieved. No user interaction is required from the victim.

php

// Patch excerpt from common/lang/en.php introducing the invalid_file filter
 $lang->filter['invalid_mid'] = 'The format of %s is invalid. Module ID should be begun with a letter. Subsequent characters may be letters, digits or underscore characters.';
 $lang->filter['invalid_number'] = 'The format of %s is invalid. Please enter numbers only.';
 $lang->filter['invalid_float'] = 'The format of %s is invalid. Please enter numbers only.';
+$lang->filter['invalid_file'] = 'The value of %s is not a valid file upload.';
 $lang->filter['invalid_extension'] = 'The format of %s is invalid. e.g. gif, jpg, png';

Source: GitHub Commit f131a61

Detection Methods for CVE-2026-36453

Indicators of Compromise

Content or document records that reference file identifiers not uploaded during the same session or by the same user.
Web server access logs showing POST or GET requests containing extra variables with numeric file identifiers outside the expected range for the account.
Unexpected access to files belonging to administrators or other tenants shortly after low-privileged content submissions.

Detection Strategies

Audit the Rhymix database for cross-user file associations by joining files and documents tables on uploader identifiers.
Compare Rhymix version strings on public endpoints against the fixed release 2.1.31 to identify vulnerable instances.
Deploy web application firewall rules that flag requests with unexpected file_srl or similar identifier parameters submitted by non-owning users.

Monitoring Recommendations

Enable verbose application logging on Rhymix module dispatch and file association handlers.
Forward web server and application logs to a centralized analytics platform for correlation of anomalous file-access patterns.
Alert on repeated failed submissions returning the new invalid_file filter message once the patch is applied, as this may indicate active probing.

How to Mitigate CVE-2026-36453

Immediate Actions Required

Upgrade all Rhymix installations to version 2.1.31 or later without delay.
Review recent content submissions and file associations for unauthorized cross-user references.
Restrict registration and content-authoring privileges to trusted accounts until patching is complete.

Patch Information

The fix is available in Rhymix 2.1.31 and is implemented in upstream commit f131a61. The patch adds server-side validation of file references supplied through extra variables and introduces the invalid_file filter error to reject invalid values. Additional context is available in the Rhymix Community Discussion.

Workarounds

Disable public account registration on affected sites until the upgrade is applied.
Limit access to content submission endpoints via reverse-proxy authentication or IP allow-listing.
Apply web application firewall rules to strip or validate file_srl and related identifier parameters from untrusted requests.

bash

# Example: check the installed Rhymix version and upgrade via git
cat /var/www/rhymix/common/defaults/config.php | grep -i version
cd /var/www/rhymix
git fetch --tags
git checkout v2.1.31
php ./common/tools/migrate.php