CVE-2026-77139
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 25, 2026
Vendor
unknown
Description
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.