Vulnerability · Published Feb 2, 2026 · Assigned by CERT-PL

CVE-2026-1186Path Traversal in EAP Legislator

High 8.6

In plain English

A high-severity path traversal in EAP Legislator from ABC PRO SP. Z O.O.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (default file type used by the Legislator application) and choose arbitrary path outside the intended directory (e.x. system startup) where files will be extracted by the victim upon opening the file. This issue was fixed in version 2.25a.

Affected products (as reported)

Vendor	Product	Versions
ABC PRO SP. Z O.O.	EAP Legislator	0 – through 2.25

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

References

https://abcpro.pl/eap-legislator product
https://cert.pl/posts/2026/02/CVE-2026-1186 third-party-advisory