PT-2026-114339

CVE-2026-92153

Published

2026-10-14

Updated

2026-10-14

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions F´ (F Prime) versions prior to 4.3.0

Description Svc::FileUplink fails to canonicalize or confine the destinationPath provided in Fw::FilePacket::StartPacket to a specific upload directory. An attacker capable of sending file-uplink packets can provide an absolute or traversing path to create or overwrite files at arbitrary writable filesystem locations, compromising system integrity and availability.

Recommendations Update to version 4.3.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-92153