Skip to content
Fencer Intel
high 8.6

CVE-2026-95378 json

Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root

published yesterday modified yesterday also EUVD-2026-125524

cvss
8.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.

This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

Patch / fix

  • Zenitel VSFF6 10.1.3.0
  • Zenitel VSFF8 10.1.3.0
  • Zenitel VSFF8MP 10.1.3.0
  • Zenitel VSFF8MN 10.1.3.0
  • Zenitel VSFT 10.1.3.0

Is CVE-2026-95378 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
yesterday

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 4.0 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P
CNA 4.0 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Zenitel VSFF6
  • Zenitel VSFF8
  • Zenitel VSFF8MP
  • Zenitel VSFF8MN
  • Zenitel VSFT

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.