CVE-2026-108582

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108582
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108582.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108582
Published
2026-10-10T15:57:50Z
Modified
2026-10-12T02:31:13Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store
Details

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108582.json"
}
References

Affected packages

Git / github.com/genspark-ai/genoffice

Affected ranges

Type
GIT
Repo
https://github.com/genspark-ai/genoffice
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1ca5e9adfc1807a158db19741eff825dba9ab757
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.11.505"
        },
        {
            "fixed": "0.11.505"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

linux-v0.*
linux-v0.5.149
v0.*
v0.10.1038
v0.10.1467
v0.10.488
v0.10.63
v0.10.639
v0.10.915
v0.11.0
v0.11.411
v0.4.110
v0.5.1
v0.5.83
v0.6.101
v0.6.13
v0.6.279
v0.6.389
v0.7.110
v0.7.204
v0.7.512
v0.7.686
v0.7.793
v0.8.0
v0.8.1039
v0.8.1360
v0.8.155
v0.8.262
v0.8.358
v0.8.440
v0.8.667
v0.8.970
v0.9.10
v0.9.431

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108582.json"