CVE-2026-46746
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6) that does not properly sanitize user input in the /api/sftp/uploadFiles endpoint. This allows the injection of shell command payloads via crafted directory names.
Risk Assessment
This vulnerability could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins), potentially leading to serious security breaches.
Recommendation
It is recommended to update SINEC INS to version V1.0 SP2 Update 6 or later and to implement appropriate input sanitization mechanisms in the application.
Original NVD description (English source)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).