CVE-2026-60114

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada dan-in-ca sustainable irrigation platform. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/sustainable-irrigation-platform-path-traversal-via-json-backup-restore advisory pihak ketiga
• https://www.zeroscience.mk/#/advisories/ZSL-2026-5996 exploit · advisory pihak ketiga