PT-2026-25674 · Undefined · Undefined

Sourbyte + 1 · Publicado 2026-03-16 · Atualizado 2026-03-16 · CVE-2026-4233

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ThingsGateway version 12

Description A path traversal issue exists in ThingsGateway version 12, specifically affecting an unknown part of the /api/file/download file. Manipulation of the fileName argument allows for path traversal. Remote exploitation is possible, and an exploit is publicly available. The vendor was contacted regarding this issue but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-4233

Produtos afetados

Undefined

Referências · 7

• 🔥 https://github.com/SourByte05/SourByte-Lab/issues/11 · Exploit
• https://t.me/CVEtracker/47537 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-4233 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033583678547492908 · Publicação no Twitter
• https://vuldb.com/?submit.771234 · Nota
• https://vuldb.com/?id.351156 · Nota
• https://vuldb.com/?ctiid.351156 · Nota