CVE-2026-8326

Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection. Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker. This issue affects SparkView: before build 1127.

CVSS

No CVSS.

References

Link	Resource
https://www.remotespark.com/view/new.html

Configurations

No configuration.

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta en Remote Spark (https://www.Remotespark.Com/) SparkView permite la lectura y escritura de archivos arbitrarios en todos los directorios como root. Esto conduce a RCE. El componente afectado es la redirección de unidades RDP. Dependiendo de la implementación, la vulnerabilidad puede ser explotada por un atacante no autenticado. Este problema afecta a SparkView: antes de la compilación 1127.

29 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 13:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-8326

Mitre link : CVE-2026-8326

CVE.ORG link : CVE-2026-8326

JSON object : View

Products Affected

No product.

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-8326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T13:33:49.958967Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Remote Spark (https://www.remotespark.com/)", "product": "SparkView", "versions": [{"status": "affected", "version": "0", "lessThan": "build 1127", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T13:16:23.770", "references": [{"url": "https://www.remotespark.com/view/new.html", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection.\u00a0\u00a0Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker.\n\nThis issue affects SparkView: before build 1127."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en Remote Spark (https://www.Remotespark.Com/) SparkView permite la lectura y escritura de archivos arbitrarios en todos los directorios como root. Esto conduce a RCE. El componente afectado es la redirecci\u00f3n de unidades RDP. Dependiendo de la implementaci\u00f3n, la vulnerabilidad puede ser explotada por un atacante no autenticado.\n\nEste problema afecta a SparkView: antes de la compilaci\u00f3n 1127."}], "lastModified": "2026-07-21T12:10:00.090", "sourceIdentifier": "vulnerability@ncsc.ch"}