External risk intelligence

NexoPOS Directory Traversal Vulnerability at api/update Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-107092

NexoPOS is a web-based point-of-sale application. The vulnerability exists within an API endpoint, which is a common deployment pattern for web-based business management software. Such applications are frequently deployed in environments where web-based interfaces and API endpoints are accessible over the network to facilitate business operations.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

NexoPOS version 6.2.4 contains a critical vulnerability that could allow unauthorized access to system files through its update API. This type of issue, known as Directory Traversal, could potentially expose sensitive information or allow for system compromise if exploited. Given its nature and the direct network accessibility of the affected endpoint, understanding the relevance of NexoPOS within your environment is a priority.

Unrestricted access to system files via an update function.
Could allow attackers to read or modify sensitive data.
Confirm if NexoPOS is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the `api/update` endpoint without needing any credentials or user interaction. This could allow them to traverse directories on the server, potentially leading to unauthorized access to sensitive files or even the ability to overwrite critical system files.

Entry condition: Network access to the `api/update` endpoint.
Trigger point: Sending a malicious request to the endpoint.
Resulting risk: Full system compromise and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in NexoPOS could allow an unauthenticated attacker to traverse directories on the server through the `api/update` endpoint. When exploited, this could lead to the unauthorized disclosure, modification, or deletion of sensitive system and user data.

System and user data could be affected.
Exposure may occur via network requests to an API endpoint.
Unauthorized data access, modification, or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NexoPOS application, specifically version 6.2.4, is susceptible to directory traversal. Ownership for addressing this critical vulnerability likely falls to the application owner or the platform team responsible for managing NexoPOS deployments. The first practical step is to identify all instances of NexoPOS, assess their exposure and business criticality, and then confirm the accountable owner before planning remediation.

Application owner or platform team.
Verify NexoPOS instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NexoPOS?

NexoPOS is a web-based point-of-sale (POS) application designed to manage business operations like sales and inventory. Because it functions as a web platform, it relies on API endpoints to handle background tasks and system communications, enabling seamless data flow between the user interface and the backend server.

What does directory traversal mean for CVE-2026-107092?

Directory traversal is a weakness where an application fails to properly filter input, allowing an attacker to navigate outside the intended folder structure. In CVE-2026-107092, this means the API endpoint can be manipulated to access or modify files on the server that should remain private, potentially leading to unauthorized data disclosure or system-level changes.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted network request to the api/update endpoint. No login credentials or prior user interaction are required to initiate this attempt. It is important to note that sending standard, legitimate updates to the software does not trigger this behavior; the issue specifically requires malicious path manipulation within the request.

Is my NexoPOS instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your NexoPOS deployment is accessible over a network, which is common for web-based business tools. If your instance is reachable via the internet or an untrusted network, the risk of unauthorized access is higher. You should verify whether your specific endpoint is exposed externally or if it is restricted to internal, private network access only.

What should I do if I run NexoPOS v6.2.4?

Your first step is to inventory all NexoPOS instances within your environment to determine which ones are running version 6.2.4. Once identified, evaluate the business criticality and network exposure of these instances. Coordinate with your platform or application team to confirm the responsible owner and prepare to implement official updates or security configurations to mitigate this risk.

References

github.com/raivenLockdown/CVE-2026-107092

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.