---
id: CVE-2026-111635
title: Helical Insight through 7.0.0 Path Traversal via /getExternalResource
summary: >-
  Helical Insight through 7.0.0 contains a path traversal vulnerability that
  allows authenticated viewers to read files outside the solution directory via
  the path parameter of /getExternalResource. Attackers can supply
  parent-directory se…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: helicalinsight
product: helicalinsight
affected:
  - helicalinsight <= 7.0.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:07.571Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111635'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli'
  - url: >-
      https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/efw/controller/EFWController.java#L547-L557
  - url: >-
      https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-path-traversal-via-getexternalresource
    label: >-
      VulnCheck Advisory: Helical Insight through 7.0.0 Path Traversal via
      /getExternalResource
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.685Z'
---

## Overview

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.

## Affected

- `helicalinsight <= 7.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.