---
id: CVE-2026-116067
title: Paisa before 0.7.8 Path Traversal via Editor and Sheet API
summary: >-
  Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile,
  GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets
  unauthenticated attackers read files and delete backups through ../ sequences
  in file names. At…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: ananthakumaran
product: paisa
affected:
  - paisa < 0.7.8
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T11:50:56.480Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116067'
references:
  - url: 'https://github.com/ananthakumaran/paisa/issues/420'
    label: 'GitHub Issue #420'
  - url: 'https://github.com/ananthakumaran/paisa'
  - url: >-
      https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70
  - url: >-
      https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31
  - url: 'https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8'
    label: v0.7.8 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api
    label: >-
      VulnCheck Advisory: Paisa before 0.7.8 Path Traversal via Editor and Sheet
      API
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.959Z'
---

## Overview

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

## Affected

- `paisa < 0.7.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.