Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-0651 is a medium-severity Path Traversal (CWE-22) vulnerability in Tp-Link Tapo C260 Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-0651 is a path traversal vulnerability (CWE-22) affecting the HTTP server in TP-Link Tapo C260 v1, D235 v1, and C520WS v2.6 devices. The issue arises during handling of GET requests, where the server performs path normalization before fully decoding URL-encoded input and falls back to the raw path if normalization fails. This logic flaw allows attackers to supply crafted, URL-encoded traversal sequences that bypass directory restrictions, enabling access to files outside the intended web root. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-10.
Attackers with low privileges (PR:L) and local access (AV:L) can exploit this vulnerability. Authenticated attackers may achieve disclosure of sensitive system files and credentials, while unauthenticated attackers can access non-sensitive static assets. Exploitation requires crafting specific URL-encoded payloads to manipulate path handling and evade normalization checks.
TP-Link advisories provide firmware download pages for the affected devices, including Tapo C260 v1 (https://www.tp-link.com/en/support/download/tapo-c260/v1/ and https://www.tp-link.com/us/support/download/tapo-c260/v1/), Tapo D235 v1 (https://www.tp-link.com/en/support/download/tapo-d235/), and Tapo C520WS v2.6 (https://www.tp-link.com/en/support/download/tapo-c520ws/ and https://www.tp-link.com/us/support/download/tapo-c520ws/). Security practitioners should apply the latest firmware updates from these sources to mitigate the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7068
Vulnerability Data
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to…
more
using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.