CVE-2026-46747

Name of the Vulnerable Software and Affected Versions SINEC INS versions prior to V1.0 SP2 Update 6

Description The application fails to properly sanitize path input in the 'GET /api/sftp/uploadFiles' endpoint used for directory listing. This allows path traversal, a technique used to access files and directories that are stored outside the web root folder, by using crafted input to reach unintended file system locations.

Recommendations Update to V1.0 SP2 Update 6 or a newer version. As a temporary workaround, restrict access to the 'GET /api/sftp/uploadFiles' endpoint to minimize the risk of exploitation.