CVE-2026-3067
Published: 24 February 2026
Summary
CVE-2026-3067 is a medium-severity Path Traversal (CWE-22) vulnerability in Hummerrisk Hummerrisk. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3067 is a path traversal vulnerability (CWE-22) in HummerRisk versions up to 1.5.0. It affects the extractTarGZ and extractZip functions within the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/CommandUtils.java, part of the archive extraction component. The issue allows malicious manipulation during archive processing, enabling remote exploitation.
An attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants limited confidentiality (C:L), integrity (I:L), and availability (A:L) impacts in an unchanged scope (S:U), as scored at CVSS 6.3 (CVSS:3.1). The exploit has been publicly disclosed and may be actively used.
Advisories from VulDB and a GitHub issue (AnalogyC0de/public_exp/issues/11) detail the vulnerability but note no vendor response despite early contact. No patches or mitigations are mentioned in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7396
Vulnerability details
A vulnerability has been found in HummerRisk up to 1.5.0. This issue affects the function extractTarGZ/extractZip of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/CommandUtils.java of the component Archive Extraction. The manipulation leads to path traversal. The attack is possible to be carried out remotely.…
more
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CWE-22) in archive extraction functions (extractTarGZ/extractZip) of network-accessible HummerRisk application enables remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates paths in tar.gz and zip archives to block path traversal sequences like '../' during extraction.
Restricts archive extraction inputs to whitelisted paths or formats, preventing processing of malicious traversal payloads.
Mandates timely remediation of the known path traversal flaw in extractTarGZ/extractZip functions, including workarounds if no vendor patch is available.