CVE-2026-36723: An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8

Synopsis

An unrestricted file rename vulnerability in the /api/create-user endpoint of bookcars v8.3 allows an authenticated attacker to move arbitrary files from temporary storage to any location on the server filesystem using directory traversal sequences. The attack is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation enables reading sensitive files, overwriting critical application files, and achieving remote code execution. HarborGuard tracks the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the bookcars service via HTTP/HTTPS.

• AuthenticationRequired

  A valid account is required, but any low-privilege user account is sufficient to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user; the attack is carried out entirely by the attacker alone.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• Reads arbitrary files from the server filesystem, including credentials, configuration files, and stored session data.
• Overwrites critical application files such as configuration, code, or startup scripts, altering application behavior.
• Achieves remote code execution by placing attacker-controlled files in executable locations on the server.
• Combines file read and write primitives to pivot further into the host environment or connected services.