CVE-2026-6620 | THREATINT

Description

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component File Upload Endpoint. The manipulation of the argument Type results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED Reserved 2026-04-19 | Published 2026-04-20 | Updated 2026-04-20 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Path Traversal

Product status

2.0

affected

Timeline

2026-04-19:	Advisory disclosed
2026-04-19:	VulDB entry created
2026-04-19:	VulDB entry last update

Credits

cccccccti (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/358255 (VDB-358255 | SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal) vdb-entry technical-description

vuldb.com/vuln/358255/cti (VDB-358255 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/792336 (Submit #792336 | SonicCloudOrg sonic-server 2.0.0 Injection) third-party-advisory

github.com/ccccccctiiiiiiii-lab/public_exp/issues/2 exploit issue-tracking

cve.org (CVE-2026-6620)

nvd.nist.gov (CVE-2026-6620)

Download JSON