CVE-2026-35082
Remote File Access via ugw-logread Method
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
Such unauthorized access to local files could lead to exposure of sensitive or personal data, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require protection of personal and health information.
However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.
Can you explain this vulnerability to me?
This vulnerability exists in the ugw-logread method, which allows a remote attacker who already has user privileges to access arbitrary local files on the system.
The root cause is insufficient validation of user-supplied input, meaning the method does not properly check or restrict the input provided by the user, enabling unauthorized file access.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can read arbitrary local files, potentially gaining access to sensitive information stored on the system.
Since the attacker requires only user privileges, this could lead to significant data exposure or leakage, escalating the impact beyond the attacker's initial access level.