Critical Severity
CVE-2026-107092
Published: Nov 2, 2026
CVE-2026-107092 is a critical directory traversal vulnerability in NexoPOS v6.2.4 affecting the api/update endpoint, where insufficient input sanitization allows unauthenticated attackers to supply path traversal sequences, escape the intended application directory, and potentially execute arbitrary files or remote code on the underlying server.
# Unauthenticated Path Traversal in NexoPOS Migration Loader Leads to Remote Code Execution
|**Product**|NexoPOS|
|---|---|
|**Affected versions**|≤ 6.2.4|
|**Fixed in**|6.3.0 (security-only backport: 6.2.5)|
|**Affected component**|`POST /api/update`|
|**Vulnerability type**|Path Traversal → Arbitrary File Inclusion → Remote Code Execution|
|**CWE**|CWE-22 (primary), chained with CWE-306, CWE-98, CWE-94, CWE-78|
|**Authentication required**|None, for the core vulnerability|
|**Status**|Reported to the NexoPOS maintainers; fixed in [PR #2653](https://github.com/Blair2004/NexoPOS/pull/2653); shipped in [v6.3.0](https://github.com/Blair2004/NexoPOS/releases/tag/v6.3.0)|
|_**CVE ID**_|[CVE-2026-107092](https://www.cve.org/CVERecord?id=CVE-2026-107092)|
|**Researcher**|Pyur11 \| Raiven Ruetas|
|**Severity**|High (vendor-classified) \| 9.8 Critical by CISA-ADP |
## Summary
NexoPOS's `POST /api/update` endpoint is used to run database migration files. The route explicitly disables the application's authentication middleware, so it can be reached without any credentials.
The endpoint accepts a migration filename supplied by the client. That filename is concatenated directly onto the application's `modules/` directory to build a filesystem path, and the resulting path is passed to PHP's `require()`. The application does not resolve the path or verify that it stays inside `modules/` before including it.
Because of this, a filename containing directory-traversal sequences (`../`) can cause the loader to step outside `modules/` and include a PHP file located anywhere else the web server process can read. Since `require()` executes PHP code, this results in arbitrary PHP execution under an unauthenticated, publicly reachable endpoint.
## Impact
Arbitrary PHP execution of this kind is equivalent to full remote code execution: any code reachable by `require()` runs with the privileges of the PHP/web server process. This was confirmed in testing to extend to arbitrary o