CVE-2026-76158
CriticalCVSS 9.3Summary
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Risk Assessment
An attacker can overwrite critical system files or place malicious files in sensitive locations, potentially leading to system compromise or data integrity violation.
Recommendation
It is recommended to immediately update Datiphy Data Management Center to a version newer than 8.5.1 and restrict access to the file upload API to trusted users only.
Original NVD description (English source)
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.