Sustainable Irrigation Platform versions up to 5.2.16 allow attackers who can access the restore functionality to upload crafted JSON backup files that contain unvalidated keys used to build file paths. The lack of key validation and the default configuration, which either requires no passphrase or uses the weak default passphrase 'opendoor', enable the application to write arbitrary JSON files to locations outside the intended data directory. This flaw constitutes a path traversal (CWE‑22) that can lead to file corruption, overwrite of critical application or system files, and potential compromise of confidentiality, integrity, and availability.

Dan‑in‑CA’s Sustainable Irrigation Platform versions 5.2.16 and earlier are affected. Users running these releases should confirm the installed version and consider upgrading.

The CVSS base score of 8.7 classifies this vulnerability as high severity, while the EPSS score of less than 1 % indicates a low but non‑zero exploitation likelihood and it is not listed in the CISA KEV catalog. Likely attack vectors involve the JSON restore endpoint, which can be accessed via a web interface or API. An attacker that controls the JSON payload can bypass the missing passphrase or use the weak default passphrase, causing the service to write arbitrary files to the filesystem. The resulting arbitrary file write can be exploited to deploy malicious code, modify critical configuration or data files, or otherwise disrupt service availability.