External risk intelligence

Mahara Artefact Access Vulnerability Through File Path Manipulation.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-42162

Mahara is an open-source ePortfolio system typically deployed as a public-facing web application for students and staff. Because the platform is designed to be accessed over the internet for collaboration and portfolio sharing, the vulnerable file path manipulation surface is highly likely to be exposed to public network traffic in standard deployments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Mahara, an ePortfolio system, that could allow unauthorized access to certain files under specific conditions involving manipulated file paths. This issue impacts certain versions of the software and, due to the nature of Mahara deployments, is considered to have a high potential for external exposure.

Unintended file access due to path manipulation.
Potential for sensitive information exposure exists.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could manipulate a file path to an artefact within a Mahara page. This could expose artefacts to unauthorized individuals under specific conditions.

Entry condition: Unauthenticated network access.
Trigger point: Manipulating artefact file paths.
Resulting risk: Unauthorized access to artefacts.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to Mahara artefact files when a page's file path is manipulated. This could affect system data when specific conditions are met.

Artefact files could be exposed.
File path manipulation may cause exposure.
Unauthorized access to system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership likely falls to the platform or infrastructure teams responsible for managing the Mahara instance, potentially with collaboration from the vendor-management team if using a hosted solution. The first practical step is to identify all Mahara deployments, confirm their accessibility and business criticality, and then assign an accountable owner for remediation planning based on the risk posed by potential artefact exposure.

Platform or infrastructure teams own resolution.
Verify Mahara instances and accessibility.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mahara and how is it used?

Mahara is an open-source ePortfolio system designed for students and staff to curate, manage, and share their academic or professional work online. Because it serves as a digital portfolio platform, it is commonly deployed as a web application intended for collaboration and networking, often hosting a variety of user-uploaded files and media known as artefacts.

What does CWE-22 mean in the context of CVE-2026-42162?

CWE-22 refers to Improper Limitation of a Pathname to a Restricted Directory, often called path traversal. In this CVE, the vulnerability allows an attacker to manipulate the file paths used to locate artefacts within the system. Instead of being restricted to intended files, the system inadvertently processes these modified paths, potentially revealing sensitive files that should have remained private.

How do attackers trigger this file path manipulation?

An attacker triggers this issue by modifying the specific file paths that point to artefacts within a Mahara page. This process does not require valid user credentials or authentication, meaning it can be attempted over the network by external parties. Simply browsing the site or accessing authorized pages normally does not trigger the bug; it requires deliberate, malicious input to the file path structure.

Is my Mahara instance likely to be exposed to this risk?

Halo Surface Signal indicates that Mahara instances are often public-facing web applications, making them inherently accessible via the internet. Because the software is designed for broad sharing and collaboration, the specific file path surface affected by this vulnerability is highly likely to be exposed to public network traffic in standard deployments.

What should I do if I run Mahara?

First, conduct an inventory to identify all active Mahara deployments within your environment. Determine which instances are accessible to the public and assess the sensitivity of the data stored within them. Once identified, assign an owner to oversee the remediation process, coordinate with your infrastructure or platform teams, and prepare to update your software to a secure version once available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.