{"cve":"CVE-2026-104806","nvd":{"published":"2026-10-05T09:17:09.540","modified":"2026-10-06T15:18:12.170","status":"Deferred","description":"DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.\n\n\n\n\nThe specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure.\n\n\n\n\nBy exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber","score":5.5},"cvss_v3":null,"cwes":["CWE-31"],"references":["https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:57:46.668721662+00:00"},"epss":{"cve":"CVE-2026-104806","score":0.00313,"percentile":0.23947,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}