Description
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Published: 2026-09-15
Score: 9.3 Critical
EPSS: 1.1% Low
KEV: No
Impact: Remote code execution and root privilege escalation
Action: Patch immediately
AI Analysis

Impact

A path traversal flaw in Tencent Mass Service Engine in Cluster (MSEC) permits an attacker who can send a crafted POST request to reference directories outside the intended file system using ".../". The vulnerability is classified as CWE-22 and allows unauthenticated remote code execution as the root user once a malicious webshell is uploaded.

Affected Systems

The affected product is Tencent Mass Service Engine in Cluster (MSEC). No specific version range was provided, so any deployment of this product is potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score of 9.3 categorizes this vulnerability as critical. The EPSS rating of less than 1% indicates that, at this time, the likelihood of exploitation is low. The flaw is not listed in CISA’s KEV catalog. Remote exploitation requires sending a crafted POST request to the file‑upload endpoint that interprets directory traversal sequences such as "../" to gain access to arbitrary filesystem locations. Once an attacker uploads a webshell through this vector, the code executes with root privileges, allowing full system compromise.

Generated by OpenCVE AI on September 18, 2026 at 18:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor-provided patch for MSEC as soon as possible.
  • Restrict network exposure by placing MSEC behind a firewall or restricting inbound traffic to trusted management IPs.
  • Continuously monitor system logs and HTTP request logs for anomalous POST requests containing path traversal patterns and promptly investigate any suspicious activity.

Generated by OpenCVE AI on September 18, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Tencent
Tencent mass Service Engine In Cluster (msec)
Vendors & Products Tencent
Tencent mass Service Engine In Cluster (msec)

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Title Tencent Mass Service Engine in Cluster (MSEC) path traversal
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tencent Mass Service Engine In Cluster (msec)
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-09-22T16:22:37.341Z

Reserved: 2026-09-10T16:43:38.518Z

Link: CVE-2026-89040

cve-icon Vulnrichment

Updated: 2026-09-22T16:22:34.367Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:19:20.240

Modified: 2026-09-22T17:17:28.647

Link: CVE-2026-89040

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T18:45:12Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')