Description
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Published: 2026-08-21
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Write leading to possible code execution
Action: Patch Immediately
AI Analysis

Impact

The flaw in the upload API endpoint allows a remote attacker to specify relative or absolute file paths, enabling the creation or overwrite of files outside the intended upload directory. This uncontrolled file write can result in sensitive configuration files being corrupted or malicious executables being stored, which in turn can provide a foothold for remote code execution. The weakness is classified as CWE‑73, External Control of File Name or Path.

Affected Systems

Datiphy Inc. Data Management Center versions 8.3.0 through 8.5.1 are affected.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is remote via the exposed upload API. If an attacker can reach this endpoint, they can manipulate file paths to write arbitrary files, making exploitation feasible under normal conditions.

Generated by OpenCVE AI on August 21, 2026 at 03:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch that corrects the path validation flaw in the upload API.
  • If a patch is unavailable, configure the upload API to reject any paths containing slashes or relative navigation and restrict write permissions to a safe, dedicated upload directory.
  • Limit exposure of the upload API to trusted networks only, or place it behind a firewall or reverse proxy that enforces strict access controls.

Generated by OpenCVE AI on August 21, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://zuso.ai/advisory cve-icon cve-icon
History

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Datiphy
Datiphy data Management Center
Vendors & Products Datiphy
Datiphy data Management Center

Fri, 21 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Description External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Title Datiphy Data Management Center - External Control of File Name or Path
Weaknesses CWE-73
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H'}

Subscriptions

Datiphy Data Management Center
cve-icon MITRE

Status: PUBLISHED

Assigner: ZUSO ART

Published:

Updated: 2026-08-21T13:01:03.052Z

Reserved: 2026-08-19T08:03:53.871Z

Link: CVE-2026-76158

cve-icon Vulnrichment

Updated: 2026-08-21T13:00:11.916Z

cve-icon NVD

Status : Deferred

Published: 2026-08-21T03:16:39.903

Modified: 2026-08-26T16:55:49.920

Link: CVE-2026-76158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:08:12Z

Weaknesses
  • CWE-73

    External Control of File Name or Path