CVE-2026-95378

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95378", "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "state": "PUBLISHED", "assignerShortName": "Zenitel", "dateReserved": "2026-09-22T05:16:24.841Z", "datePublished": "2026-11-13T15:45:14.968Z", "dateUpdated": "2026-11-13T15:45:14.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "shortName": "Zenitel", "dateUpdated": "2026-11-13T15:45:14.968Z"}, "title": "Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root", "datePublic": "2026-11-13T15:45:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}, {"capecId": "CAPEC-23", "descriptions": [{"lang": "en", "value": "CAPEC-23 File Content Injection"}]}, {"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "affected": [{"vendor": "Zenitel", "product": "VSFF6", "platforms": ["Linux", "ARM", "32 bit"], "packageName": "turbineweb", "modules": ["Certificate upload"], "versions": [{"status": "affected", "version": "10.0.3.0", "lessThan": "10.1.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "VSFF8", "platforms": ["Linux", "ARM", "64 bit"], "packageName": "turbineweb", "modules": ["Certificate upload"], "versions": [{"status": "affected", "version": "10.0.3.0", "lessThan": "10.1.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "VSFF8MP", "platforms": ["Linux", "ARM", "64 bit"], "packageName": "turbineweb", "modules": ["Certificate upload"], "versions": [{"status": "affected", "version": "10.0.3.0", "lessThan": "10.1.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "VSFF8MN", "platforms": ["Linux", "ARM", "64 bit"], "packageName": "turbineweb", "modules": ["Certificate upload"], "versions": [{"status": "affected", "version": "10.0.3.0", "lessThan": "10.1.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "VSFT", "platforms": ["Linux", "ARM", "32 bit"], "packageName": "turbineweb", "modules": ["Certificate upload"], "versions": [{"status": "affected", "version": "10.0.3.0", "lessThan": "10.1.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Path traversal in the certificate upload endpoint (<code>/api/certificate/upload</code>) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted <code>filename</code> parameter in a multipart upload request when the <code>type</code> field is set to any value other than <code>https_certificate</code>. In that case, both path validation and certificate content validation are skipped.</p><p>This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.</p>"}]}], "references": [{"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "PRESENT", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P"}}], "solutions": [{"lang": "en", "value": "Affected devices should upgrade to version 10.1.3.0 (and newer).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."}]}], "credits": [{"lang": "en", "value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Certificate upload"], "packageName": "turbineweb", "platforms": ["Linux", "ARM", "32 bit"], "product": "VSFF6", "vendor": "Zenitel", "versions": [{"lessThan": "10.1.3.0", "status": "affected", "version": "10.0.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Certificate upload"], "packageName": "turbineweb", "platforms": ["Linux", "ARM", "64 bit"], "product": "VSFF8", "vendor": "Zenitel", "versions": [{"lessThan": "10.1.3.0", "status": "affected", "version": "10.0.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Certificate upload"], "packageName": "turbineweb", "platforms": ["Linux", "ARM", "64 bit"], "product": "VSFF8MP", "vendor": "Zenitel", "versions": [{"lessThan": "10.1.3.0", "status": "affected", "version": "10.0.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Certificate upload"], "packageName": "turbineweb", "platforms": ["Linux", "ARM", "64 bit"], "product": "VSFF8MN", "vendor": "Zenitel", "versions": [{"lessThan": "10.1.3.0", "status": "affected", "version": "10.0.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Certificate upload"], "packageName": "turbineweb", "platforms": ["Linux", "ARM", "32 bit"], "product": "VSFT", "vendor": "Zenitel", "versions": [{"lessThan": "10.1.3.0", "status": "affected", "version": "10.0.3.0", "versionType": "custom"}]}], "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys."}], "id": "CVE-2026-95378", "lastModified": "2026-11-13T16:19:37.510", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "type": "Secondary"}]}, "published": "2026-11-13T16:19:37.510", "references": [{"source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}], "sourceIdentifier": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}], "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "type": "Secondary"}]}

{}

{}