CVE-2026-46746
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In SINEC INS versions prior to V1.0 SP2 Update 6, user input is not properly sanitized in the /api/sftp/uploadFiles endpoint, allowing injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved.
Risk Assessment
An authenticated remote attacker can execute arbitrary commands on the underlying operating system with the privileges of the sinecins service user, leading to full system compromise.
Recommendation
Immediately update SINEC INS to version V1.0 SP2 Update 6 or later, which includes a fix for the command injection vulnerability.
Other vulnerabilities in SINEC INS
See all- CVE-2026-46749High
SINEC INS (all versions prior to V1.0 SP2 Update 6) uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and an insufficient number of iterations. This allows an attacker to efficiently recover user passwords using brute-force or precomputed attacks (e.g., rainbow tables).
- CVE-2026-46748High
In SINEC INS prior to V1.0 SP2 Update 6, a binary is configured with the cap_dac_override capability, bypassing file system permission checks. A local attacker can escalate privileges, modify arbitrary files, and gain root access.
- CVE-2026-46747Medium
A vulnerability in SINEC INS (all versions before V1.0 SP2 Update 6) allows path traversal via the `GET /api/sftp/uploadFiles` endpoint due to improper sanitization of path input. This enables access to unauthorized file system locations.
Original NVD description (English source)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).