PT-2026-25816 · Zwickroell Gmbh & Co. Kg · Test Data Management

Arun Pratap Singh + 1 · Publicado 2026-03-16 · Atualizado 2026-05-01 · CVE-2026-29522

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ZwickRoell Test Data Management versions prior to 3.0.8

Description The software contains a local file inclusion issue in the /server/node upgrade srv.js endpoint. An attacker can provide directory traversal sequences through the firmware parameter to access arbitrary files on the server, potentially disclosing sensitive system files.

Recommendations Update to version 3.0.8 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-29522

Produtos afetados

Test Data Management

Referências · 5

• https://twitter.com/CVEnew/status/2033755316429390229 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29522 · Nota de Segurança
• https://vulncheck.com/advisories/zwickroell-test-data-management-path-traversal-lfi · Nota
• https://zwickroell.com/accessories/testxpert-testing-software/test-data-management · Nota
• https://t.me/cveNotify/161738 · Publicação no Telegram