The vulnerability lies in insufficient validation of branch codes during branch creation in the Wertheim SafeController Software. An authenticated attacker who possesses the settings_branches_manage privilege can inject path traversal sequences into a branch code, causing the software to generate filesystem paths that point outside the intended directory tree. This flaw enables the attacker to store uploaded files, profile pictures, and configuration data in arbitrary locations on the system, potentially overwriting critical files or placing data where it can be accessed or retrieved by malicious actors. The impact is not purely denial of service; it allows unauthorized file writes and may facilitate persistence or further exploitation if the service account has write access to sensitive directories.

Vendor: Wertheim GmbH. Product: Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System). Affected version: AssemblyVersion 6.15.8328.28014. The vendor has released a patch that should be applied immediately, but the exact fixed version was not disclosed. Users should contact the vendor directly to obtain the update.

The CVSS v3.1 base score for this issue is 6.9, indicating moderate to high severity. No EPSS score is available, and the vulnerability is currently not listed in the CISA KEV catalog. The flaw is exploitable only by authenticated users who have branch‑management privileges, and it requires the attacker to supply a crafted branch code. Once the conditions are met, the attacker can influence where files are written, subject to the permissions of the service account and the length restrictions on branch codes. The exploit does not require remote code execution privileges; however, unauthorized file placement could lead to exfiltration or privileged operations if the service account has elevated capabilities.