MinorCritical vulnerability

CVE-2026-108158 (CVSS 7.1)

NVD · officialPublished Oct 9, 2026Risk 23/100

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/.

Technical details

CVSS

7.1

AV:NetworkAC:LowPR:LowUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source