CVE-2026-14947
A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.94%
- CWE
- CWE-24
- Published
- 2026-08-20
- Last modified
- 2026-08-20
Affected products
- Frauscher Sensortechnik FDS 102
Weakness type
Related vulnerabilities
- CVE-2026-76353 — Path Traversal through Knowledge Bundle Replication in Splunk Enterprise
- CVE-2026-73573 — In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra...
- CVE-2026-48047 — XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
- CVE-2026-66140 — Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and...
- CVE-2026-46687 — Emlog Local File Inclusion (LFI)
- CVE-2026-44942 — libzypp .repo files can have an optional path which can lead to path traversal attacks
- CVE-2026-49103 — Webmin before 2.640 does not safely construct a filename for saving of an attachment within the...
- CVE-2026-22810 — Joplin: Path traversal in OneNote importer allows overwriting arbitrary files