CVE-2026-42162: Mahara Path Traversal Vulnerability

CVE-2026-42162 Overview

CVE-2026-42162 is a path traversal vulnerability in Mahara, an open-source ePortfolio and social networking platform. Versions before 25.04.5 and 26.04.0 allow attackers to access artefacts they should not be authorized to view. The flaw occurs when the file path to an artefact embedded in a page is manipulated. An attacker can retrieve or modify private artefacts belonging to other users by tampering with path components in requests. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated network attackers can access confidential artefacts and manipulate resources belonging to other Mahara users.

Affected Products

Mahara versions prior to 25.04.5
Mahara versions prior to 26.04.0
ePortfolio deployments exposing artefact file path parameters

Discovery Timeline

2026-08-17 - CVE-2026-42162 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-42162

Vulnerability Analysis

Mahara stores user-generated artefacts such as files, images, and journal entries, then references them through file paths within page objects. The vulnerability arises because the application does not adequately restrict how these artefact paths are resolved when a page requests an artefact. By modifying the file path parameter, an attacker can traverse outside the intended artefact scope and reference resources owned by other users. The result is unauthorized read and write access to artefacts under specific conditions described by the vendor.

The issue maps to CWE-22, improper limitation of a pathname to a restricted directory. The attack requires no authentication, no user interaction, and can be delivered over the network against any reachable Mahara instance.

Root Cause

The root cause is insufficient validation and canonicalization of artefact file paths supplied in page-rendering requests. Mahara trusts the supplied path to identify the correct artefact instead of enforcing owner and permission checks against a resolved, canonical identifier. Manipulating the path bypasses the artefact access control layer.

Attack Vector

An attacker submits a crafted request to a Mahara endpoint that renders or serves a page artefact. The request modifies the artefact file path so it resolves to an artefact owned by another user. The server returns the target artefact contents or accepts modifications to it. No credentials are required, which allows large-scale automated abuse against internet-exposed instances.

A sanitized exploit example is not published. Refer to the Mahara Forum Topic #10057 for vendor discussion of the fix.

Detection Methods for CVE-2026-42162

Indicators of Compromise

Web server access logs containing artefact-serving requests with path traversal sequences such as ../ or encoded variants like %2e%2e%2f in file path parameters.
Unexpected HTTP 200 responses for artefact IDs or file paths that do not belong to the requesting session's user.
Sudden spikes in requests to Mahara artefact download endpoints from a single IP or user agent.

Detection Strategies

Inspect Mahara application logs for artefact access events where the requesting user does not match the artefact owner recorded in the database.
Deploy WAF rules that flag path traversal patterns and directory-escape sequences in query strings and POST bodies targeting /artefact/ and page-render endpoints.
Correlate authentication state with artefact requests to identify unauthenticated or cross-account artefact reads.

Monitoring Recommendations

Enable verbose access logging on the Mahara web tier and forward it to a centralized log platform for retention and search.
Alert on outbound file transfers of unusual size from the Mahara artefact directory outside expected user workflows.
Baseline normal artefact request rates per user and alert on deviations that suggest enumeration.

How to Mitigate CVE-2026-42162

Immediate Actions Required

Upgrade Mahara to version 25.04.5, 26.04.0, or later immediately.
Restrict network exposure of Mahara instances to trusted networks or authenticated VPN users until patching is complete.
Review recent artefact access logs to identify potential unauthorized retrieval of user content.

Patch Information

The Mahara project has released fixed versions 25.04.5 and 26.04.0 that correct artefact path handling. Download the current release from the Mahara Official Site and follow the standard upgrade procedure documented in the release notes. Verify the upgrade completes cleanly and that the database schema migration succeeds before restoring public access.

Workarounds

If immediate patching is not possible, place Mahara behind a reverse proxy or WAF that blocks requests containing path traversal sequences in artefact parameters.
Enforce authentication at the proxy layer to remove unauthenticated access to artefact endpoints.
Temporarily disable public page sharing features that expose artefact file paths to unauthenticated visitors.

bash

# Example nginx rule to block path traversal in artefact requests
location ~ ^/artefact/ {
    if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://mahara_backend;
}