CVE-2026-47780
Received Received - Intake

Path Traversal in free5GC UDR SBI

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing the identifier to pass validation and enter the normal create or query flow. The advisory does not independently establish whether authentication is required. Invalid identifiers can be persisted and retrieved as subscription records, enabling unauthorized data creation, UDR namespace pollution, persistent subscriber-metadata corruption, and interference with downstream components that trust stored identifiers to use valid 3GPP formats. The exposure is most relevant in lab, test, or loosely segmented service-based-interface deployments where direct UDR access is possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-47780
EUVD
EUVD-2026-78766

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
free5gc free5gc to 4.2.3 (inc)
free5gc free5gc to 4.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper input validation issue in the free5GC UDR component. It affects the EE subscription handlers where a flawed regular expression allows arbitrary non-3GPP identifiers to bypass validation. The regex includes a catch-all alternative that accepts any non-empty string, instead of restricting identifiers to valid 3GPP formats like IMSI or MSISDN. This enables attackers with network access to inject invalid identifiers, leading to unauthorized data creation and database pollution.

Detection Guidance

To detect this vulnerability, inspect UDR SBI logs for requests to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions with non-3GPP identifiers in the ueId path parameter. Check for any identifiers not matching IMSI, NAI, MSISDN, EXTID, GCI, or GLI formats. Monitor for unauthorized subscription record creation or retrieval events.

Impact Analysis

An attacker with network access to the UDR SBI could exploit this to create or query subscription records under fake identifiers. This may result in unauthorized data creation, persistent corruption of subscriber metadata, and interference with downstream components that rely on valid identifiers. The impact includes data integrity issues and potential service disruptions in affected deployments.

Compliance Impact

This vulnerability could lead to unauthorized data creation and corruption of subscriber metadata, which may violate data integrity and access control requirements in GDPR and HIPAA. Persistent storage of invalid identifiers risks exposing personal data to unauthorized parties.

Mitigation Strategies

Immediately restrict network access to the UDR SBI to trusted sources only. Temporarily block or filter requests containing non-3GPP identifiers in the ueId parameter. Monitor and audit subscription records for unauthorized entries. Apply strict input validation by removing the trailing |.+ alternative from the regex pattern in HandleCreateEeSubscriptions and HandleQueryeesubscriptions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart