CVE-2026-22199

HighPublic PoC

Published: 13 March 2026

Published

13 March 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0016 36.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22199 is a high-severity Path Traversal (CWE-22) vulnerability in Gvectors Wpdiscuz. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Pre-auth path traversal in public-facing upload.cgi directly enables T1190 for remote file access; arbitrary filesystem reads specifically disclose password hashes (T1552.001) leading to root compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can…

exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.

Deeper analysisAI

Voltronic Power SNMP Web Pro version 1.1 is affected by CVE-2026-22199, a pre-authentication path traversal vulnerability in the upload.cgi endpoint. This flaw, classified under CWE-22, enables unauthenticated attackers to read arbitrary files on the device filesystem by injecting directory traversal sequences into the params parameter. Published on 2026-03-13 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it poses a significant confidentiality risk due to its network accessibility and lack of authentication requirements.

Unauthenticated remote attackers can exploit this vulnerability with low complexity to disclose sensitive files, including password hashes. Once obtained, these hashes can be cracked offline, granting root-level access and enabling full system compromise. The attack requires no user interaction or privileges, making it highly practical for opportunistic exploitation against exposed instances of the software.

Advisories from sources like VulnCheck and proof-of-concept exploits on GitHub (e.g., for related CVEs in the 22192-22199 range) document the path traversal leading to root RCE via credential disclosure, but no specific patches or mitigations are detailed in the available references. Security practitioners should isolate exposed Voltronic Power SNMP Web Pro devices and monitor for traversal attempts in upload.cgi traffic.