NexoPOS: Unauthenticated directory traversal in api/update endpoint

Summary

NexoPOS v6.2.4 and earlier contain a directory traversal flaw in the POST /api/update endpoint, which is used to run database migration files. The endpoint has no authentication, and the supplied filename is concatenated into a path and passed to PHP's require() without validation. According to the researcher, an unauthenticated attacker can include arbitrary PHP files and thereby achieve remote code execution with the privileges of the web server; the NVD text itself only describes the traversal.

Affected

• NexoPOS v6.2.4 (NVD)
• NexoPOS 6.2.4 and earlier (researcher and vendor advisory, not directly linked to this CVE ID)

Fixed in

• NexoPOS 6.3.0
• NexoPOS 6.2.5 (security-only backport, interim option per vendor)
• Fix referenced as PR #2653; merge status not confirmed.

Workaround

• No vendor-documented workaround found.
• Restrict network access to the update paths at a reverse proxy or firewall (recommendation, not vendor-sourced).
• Monitor web server logs for POST requests to /api/update.

Exploitation

• A public proof of concept exists according to the researcher's GitHub repository.
• CISA-ADP SSVC lists exploitation as poc and automatable as yes.
• No evidence of in-the-wild exploitation found; CISA KEV status not confirmed.

Our recommendation

• Inventory all NexoPOS installations and their versions, including the PHP version.
• Upgrade internet-facing installations to NexoPOS 6.3.0, or to 6.2.5 as an interim step.
• Check web server logs for POST requests to /api/update; do not test on production systems.
• Update PHP to a supported, patched release.
• Confirm with NexoPOS that the vendor advisory applies to CVE-2026-107092.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  raivenLockdown/CVE-2026-107092

Research sources

• NVD / CVE record (OpenCVE) app.opencve.io
• Researcher repository (GitHub) github.com
• NexoPOS security advisory my.nexopos.com
• NexoPOS pull request #2653 github.com
• VulDB entry 426423 vuldb.com
• GCVE CVE search (CISA-ADP SSVC) db.gcve.eu

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:36.