CVE Alert: CVE-2026-93014 – RosarioSIS

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users’ documents throughout the installation.

## AI Summary Analysis

**Risk verdict:** Treat this as an urgent integrity issue for exposed installations, with proof-of-concept exploitation evidence but no indication here of confirmed active exploitation.

**Why this matters:** A low-privileged account could remove application resources or other users’ documents, disrupting administration, damaging trust in records, and potentially impairing service operation. The principal attacker goals are denial of service, selective tampering, and destruction of evidence or operational data; confidentiality impact appears limited.

**Most likely attack path:** An attacker reaches the web application over the network, authenticates with any suitably limited account, and submits crafted path components to a file-deletion function; no victim interaction or unusual conditions are required. The unchanged scope indicates impact should remain within the application and host, rather than directly granting broader privileges or lateral movement, although deleted configuration and web assets may create secondary exposure.

**Who is most exposed:** Internet-facing deployments, particularly those with self-registration, shared accounts, broad student/staff access, or exposed administrative portals, are the highest concern. Installations with valuable uploaded records and weak separation between application and data directories warrant rapid review.

Alert on traversal sequences or encoded equivalents in deletion requests.

Review successful deletion actions by low-privileged accounts.

Compare web assets, configuration files, and uploaded documents against known-good hashes.

Investigate bursts of deletions, 4xx/5xx responses, or unexpected application errors.

Mitigation and prioritisation:

Patch guidance: high; upgrade promptly to the vendor-fixed release.

Restrict administrative access through VPN, allow-lists, and strong authentication.

Enforce server-side canonicalisation and directory-boundary checks as a compensating control.

Back up application assets and documents, and test restoration before change implementation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.