---
id: CVE-2026-92970
title: >-
  HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project
  file upload handlers that allows authenticated project members to write
  arbitrary files outside the project repository
summary: >-
  HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project
  file upload handlers that allows authenticated project members to write
  arbitrary files outside the project repository. Attackers can supply traversal
  sequence…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: hubzero
product: hubzero-cms
affected:
  - hubzero-cms <= 2.2.32
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92970'
references:
  - url: 'https://github.com/hubzero/hubzero-cms'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/components/com_projects/api/controllers/filesv1_0.php#L809-L880
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Filesystem/Entity.php#L53-L73
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/plugins/projects/files/connections.php#L812-L815
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hubzero/hubzero-cms/commit/4a58215463e5d42f8d03567358171383da939946
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hubzero/hubzero-cms/commit/5b4c4aefedf647390465cdfd0e7fa626c3e1cb39
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-path-traversal-via-file-upload
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0082
epssPercentile: 0.55385
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-19T02:25:48.871112Z'
ingestedAt: '2026-09-17T14:19:30.993Z'
---

## Overview

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.