CoreCVE
Back

HIGH

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem

Published Jun 9, 2026

Description

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 9, 2026
Updated Jun 10, 2026
Reserved Apr 6, 2026
Link CVE-2026-36723
CISA Vulnrichment
Updated Jun 10, 2026
NVD
Status Deferred
Modified Jul 23, 2026
Link CVE-2026-36723
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-36723