https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T12:30:46.984843+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-158410 EUVD-2026-158410 2026-10-17T12:30:47.027738+00:00 EUVD-2026-158410 https://cve.radiocsirt.org/vuln/fkie_cve-2024-42468 fkie_cve-2024-42468 2026-10-17T12:30:47.027780+00:00

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

 https://cve.radiocsirt.org/vuln/ghsa-pcwp-26pw-j98w GHSA-pcwp-26pw-j98w — CometVisu Backend for openHAB has a path traversal vulnerability 2026-10-17T12:30:47.027833+00:00

Affected: Maven: org.openhab.ui.bundles:org.openhab.ui.cometvisu

openHAB's [CometVisuServlet](https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75) is susceptible to an unauthenticated path traversal vulnerability.

Local files on the server can be requested via HTTP GET on the CometVisuServlet.

This vulnerability was discovered with the help of CodeQL's [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) query.

## Impact

This issue may lead to Information Disclosure.