PT-2026-25816 · Zwickroell Gmbh & Co. Kg · Test Data Management

Arun Pratap Singh + 1 · Published 2026-03-16 · Updated 2026-05-01 · CVE-2026-29522

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ZwickRoell Test Data Management versions prior to 3.0.8

Description The software contains a local file inclusion issue in the /server/node upgrade srv.js endpoint. An attacker can provide directory traversal sequences through the firmware parameter to access arbitrary files on the server, potentially disclosing sensitive system files.

Recommendations Update to version 3.0.8 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29522

Affected Products

Test Data Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-29522 · Security Note
• https://twitter.com/CVEnew/status/2033755316429390229 · Twitter Post
• https://vulncheck.com/advisories/zwickroell-test-data-management-path-traversal-lfi · Note
• https://zwickroell.com/accessories/testxpert-testing-software/test-data-management · Note
• https://t.me/cveNotify/161738 · Telegram Post