CVE-2026-50877: An issue in Zhoros SuperBin v1

Synopsis

A path traversal vulnerability in Zhoros SuperBin v1.0.0 allows a remote, unauthenticated attacker to request files outside the intended directory by embedding traversal characters (such as "../") in filenames sent over the network. No login or special privileges are needed to trigger the flaw. Successful exploitation gives the attacker read access to arbitrary files on the host, potentially exposing sensitive configuration, credentials, or application data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SuperBin service over the network; the service exposes this flaw to any host that can send it a request (AV:N).

• AuthenticationNot required

  No account or session token is needed; the traversal payload can be sent by any unauthenticated caller (PR:N).

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a user or administrator on the target system (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required (AC:L).

Blast Radius

• An attacker reads arbitrary files from the host filesystem, bounded only by the permissions of the process running SuperBin.
• Sensitive files such as environment variable files, private keys, and application configuration are exposed if they are readable by that process.
• No integrity or availability impact is indicated; the vulnerability is limited to unauthorized file disclosure (C:H, I:N, A:N).