Paisa: Path traversal in editor and sheet API allows file read and backup deletion
Summary
Paisa, a self-hosted personal finance manager, contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups and DeleteSheetBackups handlers. An unauthenticated remote attacker can use ../ sequences in file names sent to the editor and delete_backups endpoints to read any file the Paisa process can read. The attacker can also delete backup files outside the journal or sheets directories.
Affected
- Paisa versions before 0.7.8 (affected range 0 to below 0.7.8)
Fixed in
- Upgrade to Paisa 0.7.8 or later
Workaround
- No vendor workaround known.
- Restrict network access to the Paisa instance (firewall or VPN) until 0.7.8 is installed.
- Third-party suggestion: a web application firewall that detects path traversal patterns may reduce risk, but it is not a tested fix.
- Run the Paisa service with minimal file system permissions.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- A public Nuclei detection template exists; a Metasploit module could not be verified.
- No evidence of exploitation in the wild found; not verified against the CISA KEV catalog.
Our recommendation
- Identify all Paisa instances and check whether they are reachable from external networks.
- Update all instances to Paisa 0.7.8 or later as a priority.
- Until the update is done, restrict access to trusted networks only.
- Review what the Paisa service account can read and check for unexpected backup deletions.
- Monitor web server logs for ../ sequences in requests to the editor and delete_backups endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Paisa GitHub repository github.com
- Paisa v0.7.8 release github.com
- Fix commit 035949351f7c0d0f90ecf767aa1e28b4d5a0ae31 github.com
- Paisa issue #420 github.com
- Vulnerable code at v0.7.7 (editor.go) github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-116067 vuldb.com
- Nuclei template pull request 17537 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:37.
Original description (NVD)
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
NVD references (6)
- https://github.com/ananthakumaran/paisa
- https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70
- https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31
- https://github.com/ananthakumaran/paisa/issues/420
- https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8
- https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.