Loading story…
Apache OpenMeetings disclosed a critical path traversal vulnerability, CVE-2026-49488, that allows a user with moderator rights in any room to read arbitrary files accessible to the operating system account running the server. The flaw affects versions 5.0.0 through before 9.1.0 and can be exploited through a crafted download request, potentially exposing sensitive local files including credentials, configuration data, and other secrets stored on the host.
The issue is tracked internally as OPENMEETINGS-2821 and was credited to researchers follycat and Y0n3er. Apache said the vulnerability is fixed in OpenMeetings 9.1.0, making upgrade the primary remediation for organizations using the web conferencing and collaboration platform.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache stated that upgrading to version 9.1.0 remediates CVE-2026-49488. The disclosure credited follycat and Y0n3er with finding the issue.
A critical path traversal vulnerability in Apache OpenMeetings, tracked as CVE-2026-49488 and OPENMEETINGS-2821, was disclosed. The flaw affects versions 5.0.0 through before 9.1.0 and allows a moderator in any room to read arbitrary files accessible to the server's OS account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed two moderate-severity vulnerabilities in **Apache OpenMeetings** that affect releases before `9.0.0`, including a credential exposure issue tracked as **CVE-2026-34020**. The flaw stems from the REST login endpoint sending usernames and passwords through HTTP `GET` query parameters, which can leave credentials exposed in browser history, logs, referrers, and other URL-handling systems. Apache linked the issue to internal ticket `OPENMEETINGS-2816` and fixed it in version `9.0.0`. Apache also disclosed **CVE-2026-33005**, an improper privilege-handling flaw in `FileWebService` that lets any authenticated user retrieve metadata for files and subfolders in arbitrary folders by ID. The exposed information includes fields such as `id`, `type`, and `name`, though not file contents. Both issues were credited to **4ra2n**, described as a code security AI agent, and Apache advised users to upgrade to **OpenMeetings 9.0.0** to remediate the vulnerabilities.
Jun 29, 2026
A high-severity access control flaw tracked as **`CVE-2026-63101`** allows unauthenticated attackers to export complete group member rosters from **Open Event Server** through version **1.19.1**. The vulnerability affects the group followers CSV export workflow and can expose sensitive membership data including email addresses, names, join dates, and user roles. Attackers can brute-force sequential group IDs, submit requests to an unauthenticated CSV export `POST` endpoint, poll an unauthenticated task-status endpoint, and retrieve a download URL for the generated file. The issue is remotely exploitable and has been rated **CVSS 3.1 7.5** and **CVSS 4.0 8.7**. Recommended remediation is to upgrade to **Open Event Server 1.19.2 or later** and enforce authentication checks on the affected endpoints.
Jul 18, 2026
A high-severity vulnerability (CVE-2025-64403) was identified in Apache OpenOffice Calc, where remote documents could be loaded automatically via "external data sources" without prompting the user. This missing authorization flaw affects versions up to 4.1.15 and could allow attackers to craft malicious spreadsheet files that retrieve external content, potentially exposing users to further attacks or data exfiltration. The issue was addressed in version 4.1.16, and users are strongly advised to update to the latest release to mitigate the risk. In addition to this specific vulnerability, Apache OpenOffice released a security update addressing a total of seven flaws, including memory corruption issues and the unprompted remote content loading vulnerability. The coordinated disclosure and patch highlight the importance of keeping productivity software up to date, as attackers increasingly target document-based vectors for initial access and exploitation. Organizations using OpenOffice should review their deployment and ensure all instances are patched promptly.
Jun 29, 2026