4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import pri…

CVE-2026-41419 affects 4ga Boards, a realtime project management system. A path traversal vulnerability in versions prior to 3.3.5 allows authenticated users with board import privileges to exploit the BOARDS archive import feature. Attackers can make the server ingest arbitrary host files as board attachments during import. Once imported, these files can be downloaded through the normal application interface, leading to unauthorized local file disclosure. The vulnerability has been patched in version 3.3.5.