CVE-2026-19762
Received Received - Intake

Path Traversal in DTStack Taier via Chunk-Check Endpoint

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19762
EUVD
EUVD-2026-58556

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dtstack taier 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in DTStack Taier 1.4.0. It affects the FileChunkController.java file in the Chunk-Check Endpoint. The vulnerability allows attackers to manipulate the 'Name' argument to perform path traversal, enabling them to access arbitrary files on the host system by sending crafted requests to the deprecated /chunk/check endpoint.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the deprecated /chunk/check endpoint. Look for requests containing path traversal sequences like ../ or absolute paths in the 'name' field. Check server logs for 200 OK responses to such requests, which may indicate successful file existence checks. Use tools like curl to test the endpoint manually with crafted payloads.

Impact Analysis

This vulnerability can allow remote attackers to probe for and access sensitive files on the system hosting the Taier platform. Attackers can use path traversal sequences to discover and confirm the existence of files like configuration files or system files, leading to potential information disclosure. The endpoint is deprecated but remains accessible and lacks proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files on the host system, which may include configuration files, logs, or other data containing personal or protected information. Such access could violate GDPR's data protection principles or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately disable or remove the deprecated /chunk/check endpoint from the Taier application. Implement strict input validation for any file path parameters, rejecting traversal sequences and absolute paths. Update the FileChunkController.java to use canonical path resolution and add proper authorization checks. Monitor for any suspicious requests to the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart