CVE-2026-46747
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in SINEC INS (all versions before V1.0 SP2 Update 6) allows path traversal via the `GET /api/sftp/uploadFiles` endpoint due to improper sanitization of path input. This enables access to unauthorized file system locations.
Risk Assessment
The risk is unauthorized access to files and directories outside the intended scope, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
Upgrade SINEC INS to version V1.0 SP2 Update 6 or later.
Other vulnerabilities in SINEC INS
See all- CVE-2026-46749High
SINEC INS (all versions prior to V1.0 SP2 Update 6) uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and an insufficient number of iterations. This allows an attacker to efficiently recover user passwords using brute-force or precomputed attacks (e.g., rainbow tables).
- CVE-2026-46748High
In SINEC INS prior to V1.0 SP2 Update 6, a binary is configured with the cap_dac_override capability, bypassing file system permission checks. A local attacker can escalate privileges, modify arbitrary files, and gain root access.
- CVE-2026-46746High
In SINEC INS versions prior to V1.0 SP2 Update 6, user input is not properly sanitized in the /api/sftp/uploadFiles endpoint, allowing injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved.
Original NVD description (English source)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations.