{"uuid": "6f7e6573-10cb-4add-8a48-8d1b3b0f9010", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108158", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117411903678054707", "content": "CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108158https://hackmd.io/@haind/rJX-CmLjMehttps://github.com/mynaparrot/plugNmeet-server/blob/961b4b01cdff655928fb4b4d50524b42a6b63ec1/pkg/models/file_convert.go#L143https://github.com/mynaparrot/plugNmeet-serverhttps://www.vulncheck.com/advisories/plugnmeet-server-through-2.5.2-path-traversal-via-api-whiteboard-convert#mynaparrot #plugNmeet-server#CVE_2026_108158#bot", "creation_timestamp": "2026-10-09T16:31:12.174946Z"}