Omnispace Agora Project versions earlier than 26.10.0 contain a path traversal flaw (CWE‑22) that permits an attacker to choose an unanchored tmpFolderName in a file upload request. By providing a traversal sequence, the attacker can write files outside the intended temporary directory, potentially into the web root or other privileged locations. If the written files are executable or contain malicious payloads, the attacker can achieve remote code execution against the server.

All deployments of Omnispace Agora Project with a release before 26.10.0 are affected. The vulnerability applies to every instance that uses the default upload mechanism without input validation on the tmpFolderName parameter.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by accessing the upload endpoint and supplying a crafted tmpFolderName value. The attack requires no special privileges beyond the ability to trigger an upload. If successful, the attacker can arbitrarily write files and compromise the application, leading to full remote code execution.