CVE-2026-76652

Deferred Deferred - Pending Action

Authenticated Directory Traversal in TP-Link Archer MR600 and TL-MR6400

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: TPLink

Description

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory. Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-10-01

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-76652

Affected Vendors & Products

Vendor	Product	Version / Range
archer	mr600	From 2\|end_including=5 (inc)
tp-link	tl-mr6400	8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is an authenticated directory traversal vulnerability in file upload functionality affecting Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker could upload a specially crafted file to write outside the intended directory.

Detection Guidance

This vulnerability requires authenticated access to the file upload functionality. Detection involves checking for unauthorized file writes outside intended directories. Monitor file system changes, especially in web-accessible directories, and review upload logs for suspicious file paths containing sequences like '../'. Use commands like 'find / -type f -newer /tmp/baseline 2>/dev/null' to detect recent file modifications.

Impact Analysis

An attacker could overwrite or modify files accessible to the affected service. While arbitrary code execution has not been demonstrated, file overwrites could disrupt service functionality or lead to further compromise.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file modifications. An attacker could overwrite critical files, such as configuration or log files, which might lead to data integrity issues or unauthorized access. However, the specific impact depends on the system's configuration and the files affected.

Mitigation Strategies

Disable or restrict access to the file upload functionality on affected Archer MR600 (v2, v3, v5) and TL-MR6400 v8 devices until patches are applied. Ensure strong authentication is enforced for all users with access to administrative or upload features.

Hi! I’m here to help you understand CVE-2026-76652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70