CVE-2026-93014: Rosariosis

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

Affected products

• Rosariosis Rosariosis: before 12.9 (fixed in 12.9)

Published 2026-09-17. Last modified 2026-09-22.