CVE-2026-30996: SoftSul SAC-NFe Unauthenticated Path Traversal

CVE-2026-30996 - SoftSul SAC-NFe Unauthorized Path Traversal Vulnerability Summary Vulnerability Overview Vulnerability Type: Unauthorized Path Traversal (Arbitrary File Read) CVE ID: CVE-2026-30996 Risk Level: High (CVSS v4.0: 8.7, CVSS v3.1: 7.5) Root Cause: In the and files, the application does not perform path normalization or type validation on the user-supplied parameter. An attacker can bypass intended directory restrictions by crafting malicious paths containing sequences, thereby reading arbitrary files on the server (e.g., sensitive configuration files, source code, or system files). Affected Scope Affected Software: SoftSul SAC-NFe Affected Versions: All versions up to and including 2.0.02 Affected Platforms: PHP and Windows Affected Components: and files Remediation Recommended Measures: 1. Perform strict path normalization on the parameter. 2. Implement whitelist-based file type validation. 3. Use sandboxing mechanisms to restrict file access permissions and prevent access to sensitive system directories. Reference Link: CWE-22 Proof of Concept (POC) Code 1. Exploit Code (curl commands) Read Windows initialization file (win.ini): Read system services file (services): Read network protocol file (protocol): Read NetBIOS name resolution file (lmhosts.sam): Read binary executable file (reg.exe) and save: Read browser configuration file (browsecap.ini) and save: 2. Vulnerable Code Snippets (PHP) download.php source code: open_pdf.php source code:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-30996: SoftSul SAC-NFe Unauthenticated Path Traversal