CVE-2026-95378

Description

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.6CVSS 4.0, Highfrom the CNA (Zenitel)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P

What to do

• Affected devices should upgrade to version 10.1.3.0 (and newer).CNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-126 Path Traversal (CNA impact statement)

CAPEC-23 File Content Injection (CNA impact statement)

CAPEC-165 File Manipulation (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-22
• CWE-434

References

• www.zenitel.com