Description
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Published: 2026-08-21
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in the upload API endpoint allows a remote attacker to specify relative or absolute file paths, enabling the creation or overwrite of files outside the intended upload directory. This uncontrolled file write can result in sensitive configuration files being corrupted or malicious executables being stored, which in turn can provide a foothold for remote code execution. The weakness is classified as CWE‑73, External Control of File Name or Path.

Affected Systems

Datiphy Inc. Data Management Center versions 8.3.0 through 8.5.1 are affected.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is remote via the exposed upload API. If an attacker can reach this endpoint, they can manipulate file paths to write arbitrary files, making exploitation feasible under normal conditions.

Generated by OpenCVE AI on August 21, 2026 at 03:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch that corrects the path validation flaw in the upload API.
  • If a patch is unavailable, configure the upload API to reject any paths containing slashes or relative navigation and restrict write permissions to a safe, dedicated upload directory.
  • Limit exposure of the upload API to trusted networks only, or place it behind a firewall or reverse proxy that enforces strict access controls.

Generated by OpenCVE AI on August 21, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://zuso.ai/advisory cve-icon cve-icon
History

Fri, 21 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Description External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Title Datiphy Data Management Center - External Control of File Name or Path
Weaknesses CWE-73
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ZUSO ART

Published:

Updated: 2026-08-21T02:02:23.070Z

Reserved: 2026-08-19T08:03:53.871Z

Link: CVE-2026-76158

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-21T03:16:39.903

Modified: 2026-08-21T03:16:39.903

Link: CVE-2026-76158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T03:45:03Z

Weaknesses
  • CWE-73

    External Control of File Name or Path