CVE-2026-34026

The record

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation, allowing an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application. This includes, but is not limited to, application log files containing sensitive information and application binaries.

Affected packages

Related vulnerabilities

• CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal… CWE-23
• CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files… CWE-23
• CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen before… CWE-23
• CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the… CWE-23
• CVE-2026-15913 In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles… CWE-23
• CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. CWE-23
• CVE-2026-67367 A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13)… CWE-23
• CVE-2026-80130 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-23