CVE-2026-5027
Published: 27 March 2026
Summary
CVE-2026-5027 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validating the 'filename' parameter in multipart form data to block path traversal sequences like '../'.
Enforces restrictions on information inputs at the API endpoint boundary to permit only safe filenames without traversal characters.
Mandates enforcement of access controls to restrict file writes to authorized filesystem locations despite path traversal attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public /api/v2/files endpoint directly enables initial access via T1190; arbitrary file write facilitates tool ingress (T1105) and web shell deployment (T1505.003) to web-accessible paths.
NVD Description
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
Deeper analysisAI
CVE-2026-5027, published on 2026-03-27, is a path traversal vulnerability (CWE-22) affecting the 'POST /api/v2/files' endpoint. This endpoint fails to sanitize the 'filename' parameter in multipart form data, allowing attackers to use path traversal sequences such as '../' to write files to arbitrary locations on the filesystem. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
An attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). By crafting a malicious multipart form request with a traversed 'filename' parameter, the attacker can upload and write files to sensitive locations, potentially leading to arbitrary file writes, data corruption, or further compromise depending on the writable paths and server permissions.
Mitigation details are available in the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-26.
Details
- CWE(s)