PT-2026-33194 · Drivelock · Drivelock

CVE-2026-5492 · Published 2026-04-15 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DriveLock (affected versions not specified)

Description An issue exists in the web service that listens on TCP port 4568 by default, where the application fails to properly validate user-supplied paths before using them in file operations. This allows authenticated remote attackers to perform a directory traversal, which is a method used to access files and directories that are stored outside the web root folder, resulting in the disclosure of sensitive information in the context of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5492

ZDI-26-288

Affected Products

Drivelock

References · 5

• https://drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5492 · Security Note
• https://twitter.com/SystemTek_UK/status/2046596616778396087 · Twitter Post
• https://t.me/CVEtracker/61642 · Telegram Post