CVE-2026-5027 - Vulnerability Analysis

Overview

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.

Severity & Score

Impact

Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.

Mitigation

Sanitize the 'filename' parameter to prevent path traversal or update to the latest secure version.

References

• https://www.tenable.com/security/research/tra-2026-26

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🟠 CVE-2026-5027 - High (8.8) The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../'). 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5027/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner