CVE-2026-12339
Received Received - Intake

Zip Slip Vulnerability in WebUI ISP Upgrade

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: TPLink

Description
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-12339
EUVD
EUVD-2026-55700

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Zip Slip vulnerability in the WebUI ISP Upgrade functionality. It allows an authenticated administrator to write arbitrary files on the system by exploiting directory traversal sequences in a crafted archive. This can lead to overwriting critical files, affecting system integrity and availability.

Detection Guidance

Detecting Zip Slip vulnerabilities typically involves inspecting archive uploads and file writes. Check for unusual file paths in logs or file system changes. Look for sequences like '../' in filenames during archive extraction. Monitor for unexpected file modifications in system directories.

Impact Analysis

An attacker with admin access could overwrite system files, leading to system crashes, data corruption, or unauthorized code execution. This compromises system stability and security, potentially allowing further attacks.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized file modifications, potentially exposing sensitive data or disrupting critical services. GDPR and HIPAA require protecting data integrity and availability, which this vulnerability undermines.

Mitigation Strategies

Immediately update the WebUI ISP software to the latest patched version. Restrict file write permissions to only necessary directories. Disable archive uploads if not required. Implement strict input validation for filenames in archives. Monitor system files for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart