CVE-2026-1186

HIGH EPSS 26.3%

Published Feb 2, 20264mo ago · Modified Jun 17, 20262w ago

8.6 CVSS 4.0

High

Published Feb 2, 2026 4mo ago

Last Modified Jun 17, 2026 2w ago

Description

EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (default file type used by the Legislator application) and choose arbitrary path outside the intended directory (e.x. system startup) where files will be extracted by the victim upon opening the file. This issue was fixed in version 2.25a.

CVSS Details

Base Score

8.6

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

26.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 2

abcpro.pl https://abcpro.pl/eap-legislator
cert.pl https://cert.pl/posts/2026/02/CVE-2026-1186

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.