CVE-2026-1616 HIGH

CVE-2026-1616: osim: Path Traversal via query parameters in Nginx configuration

Vendor Red Hat

Product osim

Weakness CWE-22 · Path traversal

Published January 29, 2026

Last update January 29, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.

Key dates

02Disclosure timeline

January 29, 2026 CVE published

January 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1616 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter CVE-2026-5114 SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1