CVE-2026-20358
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20358 are related to external control of the file system issues that are grouped Common Weakness Enumeration (CWE) CWE-73.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
- EPSS probability
- 0.46%
- CWE
- CWE-73
- Published
- 2026-08-19
- Last modified
- 2026-08-21
Affected products
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
- Cisco Cisco Crosswork Planning
Weakness type
Related vulnerabilities
- CVE-2026-50148 — Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2026-11526 — GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle
- CVE-2026-67429 — Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
- CVE-2025-71338 — Flowise - Arbitrary File Write to Remote Code Execution via document-store API
- CVE-2026-48750 — Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
- CVE-2026-9559 — A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files dur
- CVE-2026-63343 — Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-48753 — Incus has an arbitrary file write via path traversal in S3 multipart upload