PatchTheCVE: iobrokerhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-10771: Characters in the GET url path are not properly escaped and can be reflected in the server response.https://patchthecve.com/cve/CVE-2019-10771.htmlhttps://patchthecve.com/cve/CVE-2019-10771.htmlWed, 17 Jun 2026 02:11:38 +0000MEDIUM 6.1: Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-10767: An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of ahttps://patchthecve.com/cve/CVE-2019-10767.htmlhttps://patchthecve.com/cve/CVE-2019-10767.htmlWed, 17 Jun 2026 02:11:38 +0000HIGH 7.5: An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enCVE-2019-10765: iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directoryhttps://patchthecve.com/cve/CVE-2019-10765.htmlhttps://patchthecve.com/cve/CVE-2019-10765.htmlWed, 17 Jun 2026 02:11:37 +0000CRITICAL 9.8: iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.