A path traversal vulnerability exists in the GET /api/sftp/uploadFiles endpoint of Siemens SINEC INS. The application does not sanitize the path component of the request, enabling a crafted input to reference directories outside the intended storage area and therefore access unintended file system locations. This flaw permits an attacker to read arbitrary files stored on the server, potentially exposing sensitive information, or to write to locations that may be within the application’s directory structure if write permissions exist.

All versions of Siemens SINEC INS released before V1.0 SP2 Update 6 are affected. Users running legacy releases are at risk, regardless of deployment environment, because the path sanitization bug resides in the core API layer.

The CVSS score is 5.3, classifying the issue as moderate in severity. An EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as an attacker can issue a crafted HTTP GET request to the vulnerable endpoint over the network. Successful exploitation can lead to confidentiality exposure by reading files outside the intended directory or to unauthorized file modification if the resolved path is writable.