CVE-2026-4542
Path Traversal in SSCMS 4.7.0 LayerImage Endpoint Allows Remote Exploit
Publication date: 2026-03-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SSCMS version 4.7.0 within an unknown function of the file LayerImageController.Submit.cs, specifically in the layerImage Endpoint component. It involves manipulation of the argument 'filePaths' which leads to a path traversal vulnerability. This means an attacker can manipulate file path inputs to access files or directories outside the intended scope.
The attack can be performed remotely, and the exploit has already been publicly disclosed, making it potentially usable by attackers.
How can this vulnerability impact me? :
The vulnerability allows an attacker to perform path traversal via the 'filePaths' argument, potentially enabling unauthorized access to files or directories on the affected system.
Such unauthorized access can lead to information disclosure, modification of files, or other malicious activities depending on the system's configuration and the attacker's intent.
Given that the exploit is publicly known and can be executed remotely, the risk of exploitation is increased.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know