CVE-2026-8736 — Oinone Pamirs Path Traversal

title: CVE-2026-8736 - Oinone Pamirs Path Traversal Attempt
id: scw-2026-05-17-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-8736 in Oinone Pamirs by looking for path traversal sequences within the URI and the presence of the 'uniqueFileName' parameter in the query string. This indicates an attempt to access files outside the intended directory.
author: SCW Feed Engine (AI-generated)
date: 2026-05-17
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8736/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/..%252F'
          - '/..%255C'
          - '/..%2f'
          - '/..%5c'
      cs-uri-query|contains:
          - 'uniqueFileName'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse