CVE-2026-5027

High

Published: 27 March 2026

Published

27 March 2026

Modified

30 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0210 79.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-5027 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Deeper analysis

CVE-2026-5027, published on 2026-03-27, is a path traversal vulnerability (CWE-22) affecting the 'POST /api/v2/files' endpoint. This endpoint fails to sanitize the 'filename' parameter in multipart form data, allowing attackers to use path traversal sequences such as '../' to write files to arbitrary locations on the filesystem. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

An attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). By crafting a malicious multipart form request with a traversed 'filename' parameter, the attacker can upload and write files to sensitive locations, potentially leading to arbitrary file writes, data corruption, or further compromise depending on the writable paths and server permissions.

Mitigation details are available in the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-26.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-16668

Vulnerability details

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Path traversal in public /api/v2/files endpoint directly enables initial access via T1190; arbitrary file write facilitates tool ingress (T1105) and web shell deployment (T1505.003) to web-accessible paths.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0