CVE-2026-27897

CVE-2026-27897 is a directory traversal vulnerability affecting Vociferous versions prior to 4.4.2, allowing an unauthenticated attacker to write arbitrary data to any location accessible by the application's permissions. This flaw stems from inadequate validation of filenames in the export_file API route, combined with an unauthenticated API and overly permissive CORS, enabling an external attacker to bypass intended UI controls. Rated 7.1 HIGH, its impact is severe, potentially leading to high integrity and availability compromise by allowing arbitrary file creation or modification on the system. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.