CVE-2026-35076
Remote File Deletion via bac-scanresult Method
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mbs | universal_gateways | to 6.0.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
This unauthorized file deletion could potentially lead to data loss or disruption of system integrity, which may impact compliance with standards such as GDPR or HIPAA that require protection of data integrity and availability.
However, there is no explicit information provided about direct effects on compliance with these regulations.
Can you explain this vulnerability to me?
This vulnerability exists in the bac-scanresult method, which allows a remote attacker who has user privileges to delete arbitrary local files. The issue arises because the method does not properly validate input that is controlled by the user, enabling the attacker to specify files to delete.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized deletion of local files by an attacker with user privileges. This can result in loss of important data, disruption of services, and potential system instability depending on which files are deleted.