Description
A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.
Published: 2026-07-14
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a path traversal flaw in Rockwell Automation FactoryTalk ThinManager. Improper validation of file paths within the API allows an authenticated user to write files to directories outside of the intended application folder. The write operation can target restricted system directories, enabling placement of arbitrary files that may alter system configuration or interfere with application behavior.

Affected Systems

The vulnerability affects Rockwell Automation FactoryTalk ThinManager. No specific product versions are listed in the advisory, so all deployments of this software should be considered potentially vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.2 indicates a high impact potential, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. An attacker must authenticate to the service in order to reach the vulnerable file-write operation, but once authenticated the flaw removes directory boundaries, enabling arbitrary file placement in restricted directories.

Generated by OpenCVE AI on July 31, 2026 at 10:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided security patch released in the Rockwell Automation advisory.
  • Reduce write permissions on critical system directories so that the ThinManager service account or other accounts cannot overwrite essential files.
  • Restrict the API functionality that allows file writes to only users who truly need it by revoking or limiting permissions on those accounts.
  • Continuously monitor application and system logs for attempts to write files outside the expected directory and configure alerts for suspicious activity.

Generated by OpenCVE AI on July 31, 2026 at 10:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.
Title ThinManager® - Path Traversal via API
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Rockwell

Published:

Updated: 2026-07-14T15:54:01.677Z

Reserved: 2026-06-10T16:54:28.573Z

Link: CVE-2026-11917

cve-icon Vulnrichment

Updated: 2026-07-14T15:53:58.811Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:30:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')