CVE-2026-76158
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Risk Assessment
An attacker can overwrite critical system files or place malicious files in sensitive locations, potentially leading to system compromise or data integrity violation.
Recommendation
It is recommended to immediately update Datiphy Data Management Center to a version newer than 8.5.1 and restrict access to the file upload API to trusted users only.
Other vulnerabilities in Datiphy Data Management Center
See all- CVE-2026-76156Critical
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
- CVE-2026-76155Critical
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
- CVE-2026-76157High
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
Original NVD description (English source)
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS