PT-2026-33193 · Drivelock · Drivelock

CVE-2026-5491 · Published 2026-04-15 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DriveLock (affected versions not specified)

Description An issue exists in the web service that listens on TCP port 6067 by default, where the application fails to properly validate user-supplied paths before using them in file operations. This allows remote, unauthenticated attackers to perform directory traversal to disclose sensitive information in the context of the service account. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5491

ZDI-26-287

Affected Products

Drivelock

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-5491 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-287 · Security Note
• https://drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm · Vendor Advisory
• https://t.me/CVEtracker/61641 · Telegram Post