# CVE-2026-116067: Paisa - Path Traversal

> Live exploitation tracking for CVE-2026-116067 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-116067

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Ananthakumaran Paisa
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_application

## Description

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

## CrowdSec analysis

[CVE-2026-116067](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-116067) is a high-severity path traversal vulnerability in Paisa versions before 0.7.8. Unauthenticated remote attackers can use crafted `../` file names in affected endpoints to read server-accessible files and delete backups outside the intended directories, potentially exposing sensitive data and disrupting recovery.

CrowdSec has been tracking this vulnerability and its exploits since 26th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-116067 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/api/editor/file` and `/api/sheets/file` with JSON requests containing traversal sequences such as `../` in the `name` field. These requests attempt to read files outside the intended directories without authentication.

## Timeline

- 2026-10-25: CVE Published. CVE-2026-116067 is published to NVD.
- 2026-10-26: Rule Released. CrowdSec releases a rule to detect CVE-2026-116067 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8
- https://github.com/ananthakumaran/paisa
- https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70
- https://github.com/ananthakumaran/paisa/issues/420
- https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31
- https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-116067.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-116067) follows observed exploitation activity for CVE-2026-116067. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.