CVE-2026-61343: LibreBooking Path Traversal & Code Execution via Email Template Editor

Technical summary

CVE-2026-61343 is a path traversal vulnerability (CWE-23: Relative Path Traversal) in LibreBooking's email template management functionality. The save action in the template editor concatenates user-supplied input directly into the file destination path without sanitization or validation. An authenticated administrator can inject path traversal sequences to escape the template directory and write arbitrary files to the filesystem. This permits writing executable code to locations where it will be processed by the application server, resulting in code execution with the privileges of the web application. The vulnerability requires valid administrator credentials but no user interaction.

Business impact

An internal threat actor or compromised administrator account can gain full control of the LibreBooking server and potentially the underlying infrastructure. The attacker can read sensitive data (customer bookings, payment information, credentials), modify application behavior, inject malicious content served to users, or pivot to other systems. For hosted SaaS deployments, this affects data confidentiality, integrity, and availability. For self-hosted instances, the blast radius includes the entire host environment. Recovery requires server reimaging and credential rotation. Reputational and compliance impacts (GDPR, PCI-DSS) are substantial if customer data is compromised.

Affected systems

LibreBooking versions prior to 5.1.0 are affected. The vulnerability exists in the email template editor feature and is exploitable by any user with administrator role privileges. Deployments on shared hosting environments, cloud instances, or network-accessible systems where administrator accounts could be compromised are at heightened risk.

Exploitability

Exploitability is straightforward for an attacker with administrator credentials. No special tools or complex techniques are required—the attack is a simple HTTP request with a crafted template name. However, the requirement for authenticated admin access limits the attack surface to compromised credentials, insider threats, or environments with weak access controls. The CVSS score of 7.2 (HIGH) reflects the high impact (confidentiality, integrity, availability all affected) balanced against the requirement for privileged credentials.

Remediation

Upgrade to LibreBooking 5.1.0 or later, which implements proper input validation and path canonicalization in the template save function. For organizations unable to patch immediately, implement network-level access controls restricting admin console access to trusted IP ranges, enforce strong authentication (MFA) for administrator accounts, and monitor file system activity for unusual write operations in web-accessible directories. Review administrator account privileges and audit logs for any suspicious template save operations.

Patch guidance

LibreBooking 5.1.0 addresses this vulnerability. Verify the version in your installation by checking the About or Settings page. Update by downloading the latest release from the official LibreBooking project repository and following the upgrade documentation. Test the upgrade in a staging environment first, particularly if you have custom email templates. After patching, verify that existing templates still render correctly and that the template editor save function works as expected.

Detection guidance

Monitor for HTTP POST requests to the email template editor endpoint with suspicious characters or sequences in the template name parameter (e.g., `../`, `..\`, URL-encoded variants like `%2e%2e%2f`). Review web server logs and application access logs for admin user activity in the template editor. Examine the filesystem for unexpected files in parent directories of the template folder or in web root. Check for recently created executable files (.php, .jsp, .aspx) in unusual locations. Enable and centralize application logging if available, and correlate admin login times with file system modifications.

Why prioritize this

While the CVSS score is HIGH (7.2), this vulnerability requires admin credentials, limiting the immediate risk. However, if an organization has weak admin credential hygiene, shared credentials, or if the advisory indicates proof-of-concept or active exploitation, this should be prioritized within 30 days. Organizations running LibreBooking in sensitive environments (e-commerce, healthcare booking, multi-tenant SaaS) should patch sooner. The path traversal + code execution combination is critical, so treat as priority if any admin account compromise is suspected.

Risk score, explained

The CVSS v3.1 score of 7.2 (HIGH) is derived from: network-accessible attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), no user interaction (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The privilege requirement prevents a critical rating but the ability to achieve code execution with high impact justifies the HIGH classification. Organizations should not discount this as low-priority based on the privileged access requirement—admin account compromise is a realistic threat.

Frequently asked questions