CVE-2026-19762 is a path traversal vulnerability in the Paths.ge utility used by FileChunkController's chunk-check endpoint. The CVSS 7.3 score undersells this significantly — here's why, and what you should do about it.
The function name matters. The '.ge' suffix indicates an abstracted getter or utility method, not business logic written fresh by a developer. This is the critical insight: when path operations live in utility classes with generic names, developers calling those helpers don't think of themselves as handling filesystem operations at all — the security implications become invisible because the complexity is hidden. This cognitive displacement is the actual systemic failure, and it's why this pattern recurs across frameworks and years despite extensive OWASP documentation.
The chunked upload context compounds the problem. You're debugging why chunks aren't assembling correctly, not thinking about whether the Name parameter could escape its intended directory. But more than that — a traversal in a chunked upload isn't just a file read. An attacker can plant partial files, then trigger reassembly with a traversal payload in a later chunk's metadata. That's a different threat model than standard path traversal: think race conditions, not just directory escape.
Here's the action checklist. First, audit your codebase for other call sites to Paths.ge or similar abstracted path utilities — if this vulnerability exists in a helper class, assume it propagates until proven otherwise. Second, check whether FileChunkController or similar chunking logic has been touched in the last 18 months; if not, that's a red flag — orphaned chunk handlers are precisely where this pattern survives. Third, review your framework's documentation on file-handling utilities — if DTStack's docs describe Paths.ge as safe for untrusted input, that's a documentation failure compounding the code failure. Finally, when patching, refactor the utility itself rather than just hardening the reported endpoint; CVSS doesn't capture that an abstracted utility left insecure will seed the next CVE.
The public exploit availability is your loudest signal. Attackers recognize this pattern instantly — they don't trace call graphs to find blast radius, they see path traversal in a file-chunk utility and act. Assume active exploitation is already underway.