Omnispace Agora-Project: Path Traversal in file upload via tmpFolderName
Summary
Omnispace Agora-Project before 26.10.0 contains a path traversal vulnerability in the file upload handling. An unanchored tmpFolderName value in the upload destination path lets an attacker write files outside the intended temporary directory, for example into the web root. An attacker with a valid low-privileged account can thus place attacker-controlled files and may achieve remote code execution. The CVSS v4.0 base score is 8.7 (High).
Affected
- Omnispace Agora-Project versions 0 to before 26.10.0
Fixed in
- Version 26.10.0 or later (vendor release 26.10 on GitHub)
Workaround
- No vendor workaround known. Updating is the fix.
- If an update is not possible at once, restrict access to trusted networks or VPN.
- Review whether self-registration is enabled and remove unused accounts.
- Check that upload folders cannot execute scripts.
- Look for unexpected files in web-accessible folders.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- No known exploitation in the wild found.
- Public proof of concept: unknown.
Our recommendation
- Identify all Agora-Project instances, especially internet-facing and shared-hosting installations.
- Update to version 26.10.0 or later, using the current 26.10.x release from the vendor's GitHub releases page.
- Check whether the installer is still present on any deployment, as a separate critical installer issue (CVE-2026-63146) is reported.
- Review web-accessible upload folders and file system for unexpected or script files.
- Monitor web server logs for unusual upload requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Agora-Project GitHub release 26.10 github.com
- VulnCheck advisory: Omnispace Agora Project path traversal via tmpFolderName www.vulncheck.com
- OSV: CVE-2026-63162 osv.dev
- Agora Project vendor website www.agora-project.net
- Strix: CVE-2026-63162 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:15.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.