CVE-2026-36723: bookcars Path Traversal Vulnerability

CVE-2026-36723 Overview

CVE-2026-36723 is an unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3. Authenticated attackers can supply directory traversal sequences to move arbitrary files from temporary storage to attacker-chosen locations on the server filesystem. Successful exploitation enables unauthorized access to sensitive files, overwrites of critical application files, and remote code execution (RCE). The flaw is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and requires only low-privilege authenticated access over the network.

Critical Impact
Authenticated attackers can achieve remote code execution by relocating uploaded files into executable application paths through path traversal in the /api/create-user endpoint.

Affected Products

bookcars v8.3

Discovery Timeline

2026-06-09 - CVE-2026-36723 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36723

Vulnerability Analysis

The /api/create-user endpoint in bookcars v8.3 accepts a filename parameter that is used to rename or move files from a temporary upload directory to a destination path. The application does not normalize or validate the destination filename, so an authenticated attacker can embed ../ traversal sequences to escape the intended upload directory. This relocates attacker-controlled content to arbitrary server paths, including web-accessible or executable locations.

Because the destination is fully attacker-controlled, the vulnerability collapses several impact classes into one. An attacker can overwrite configuration files, drop scripts into web roots, or replace existing JavaScript and template files used by the running application. The data manipulation paths lead directly to remote code execution under the privileges of the bookcars process.

The issue requires authentication, but bookcars permits self-service user creation in standard deployments, lowering the practical barrier to exploitation.

Root Cause

The root cause is missing input sanitization on the filename parameter consumed by the user-creation handler. The code path performs a file rename operation using a path constructed from untrusted input without canonicalization, an allowlist of characters, or a check that the resolved path remains inside the intended upload directory.

Attack Vector

Exploitation occurs over the network against an authenticated session. The attacker submits a crafted request to /api/create-user containing path traversal sequences in the file or avatar parameter. The server moves the temporary file to the traversed destination, where it can be served, executed, or interpreted as application code. Refer to the GitHub Vulnerability Repository for the proof-of-concept request structure.

Detection Methods for CVE-2026-36723

Indicators of Compromise

HTTP requests to /api/create-user containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f in filename or avatar fields.
New or modified files appearing outside the bookcars upload directory, particularly inside web roots, node_modules, or static asset directories.
Unexpected child processes spawned by the bookcars Node.js process following user-creation activity.

Detection Strategies

Inspect application and reverse-proxy logs for /api/create-user requests with suspicious filename parameters and correlate them with subsequent filesystem changes.
Deploy file integrity monitoring on the bookcars deployment directory to alert on writes outside the designated uploads path.
Add web application firewall rules that block traversal patterns on multipart fields targeting the user-creation endpoint.

Monitoring Recommendations

Capture and retain full request bodies for authenticated API traffic to bookcars to support post-incident forensics.
Monitor outbound network connections from the bookcars host for reverse shells or command-and-control beacons.
Alert on writes to JavaScript, JSON configuration, or template files within the application directory that occur outside of deployment windows.

How to Mitigate CVE-2026-36723

Immediate Actions Required

Restrict access to /api/create-user to trusted networks or disable self-service registration until a patched release is deployed.
Audit the bookcars filesystem for files written outside the upload directory and compare critical application files against a known-good baseline.
Rotate any secrets, API keys, or session tokens stored on the host if exploitation is suspected.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the GitHub Vulnerability Repository and the upstream bookcars project for a fixed release that introduces filename sanitization and path canonicalization on the user-creation endpoint.

Workarounds

Place bookcars behind a reverse proxy that strips or rejects traversal sequences in multipart filename fields.
Run the bookcars service as an unprivileged user with write access limited to the uploads directory using filesystem ACLs or mount options.
Enforce a strict allowlist of filename characters (alphanumeric, dash, underscore, single dot) at the proxy or WAF layer before requests reach the application.

bash

# Example NGINX rule to block traversal sequences on the create-user endpoint
location /api/create-user {
    if ($request_body ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://bookcars_backend;
}