---
id: CVE-2026-76806
title: >-
  Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory
  creation + filesystem existence oracle
summary: >-
  Solidtime is an open-source time-tracking app. Prior to 0.16.0,
  TogglDataImporter::importData() read attacker-controlled project id values
  from projects.json in uploaded ZIP imports and concatenated them into
  filesystem paths without val…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: solidtime-io
product: solidtime
affected:
  - solidtime < 0.16.0
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T19:31:54.604Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-76806'
references:
  - url: >-
      https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j
    label: >-
      https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j
  - url: >-
      https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be
    label: >-
      https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be
  - url: 'https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0'
    label: 'https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.521Z'
epss: 0.00251
epssPercentile: 0.16698
---

## Overview

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\TemporaryDirectory\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.

## Affected

- `solidtime < 0.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.