solidtime vulnerabilities

CVEs whose affected-version data names the solidtime package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-76806Medium· 6.3

4d ago

Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without val…

▾ Sunlitsolidtime-io · solidtimeEPSS 0.25%via CVEORG