TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary file read to any user with moderator rights in a room. Version 9.1.0 fixes the issue, and no exploitation or public proof-of-concept has been confirmed. Why It Matters OpenMeetings powers video conferencing, whiteboards, and document collaboration for many self-hosted deployments. Moderator rights are not a high bar, since organizations often hand them to ordinary staff.