CVE-2026-34028

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not properly validate the branch code when creating a new branch. This allows an attacker with the appropriate privileges to include path traversal sequences, potentially leading to unintended file storage.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application accepts uploaded files based on the user-controlled HTTP Content-Type value, allowing authenticated attackers to upload arbitrary file content.

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. This allows an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. An attacker with valid branch user credentials can manipulate the X-Forwarded-For header to spoof the expected branch IP address and obtain a valid authenticated session from an unauthorized network location.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages, allowing access to restricted functions in other branches.