CVE-2023-26469: Jorani path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and public exploit references make this an urgent fix despite the absence of KEV listing.

What it is

Jorani 1.0.0 contains a path traversal flaw (CWE-22) that lets an attacker reach files outside the intended directory and execute code on the server. The record names only version 1.0.0, so no other affected or fixed versions can be confirmed from the data. With a CVSS 3.1 base score of 9.8 and a very high EPSS probability, this is a severe, remotely reachable issue.

Impact

An unauthenticated attacker can read arbitrary files and execute code on the server, giving full compromise of confidentiality, integrity and availability. That typically means control of the application host and any data or credentials it can reach.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:N, so the flaw is reachable over the network with no authentication and no user interaction. The description does not identify the specific endpoint or parameter, so the exact entry point cannot be confirmed from this record.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.82949 (99.656th percentile) and multiple references are tagged Exploit, including a Packet Storm remote code execution writeup. Public exploit material therefore appears to exist, though the record does not state whether it is being used in the wild.

What to do

• Upgrade Jorani to a version that fixes the path traversal; the record only names 1.0.0 as affected, so confirm the fixed release with the vendor before upgrading.
• If patching is not immediately possible, restrict network access to the Jorani instance to trusted users and networks.
• Run the application with least privilege and confine its file access so traversal cannot reach sensitive paths or writable code locations.
• Review the vendor security page (jorani.org/security-features-in-lms.html) for hardening guidance and any interim workarounds.

Detection

• Monitor web logs for traversal patterns such as ../, encoded variants (%2e%2e%2f), and absolute paths in request parameters.
• Alert on unexpected file reads or writes by the web server user outside the application directory.
• Watch for new or modified executable files under the web root or other writable paths, which may indicate code execution.
• Correlate outbound connections or child processes spawned by the Jorani web service with normal baseline behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.