CVE-2026-105286CWE-22path-traversal

CVE-2026-105286

Medium · published October 5, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-05T14:16Z
References (6)
https://gist.github.com/H3rmesk1t/b107cde70392e0aff26e8219bae1a181 · [email protected]https://vuldb.com/cve/CVE-2026-105286 · [email protected]https://vuldb.com/submit/977225 · [email protected]https://vuldb.com/vuln/413467 · [email protected]https://vuldb.com/vuln/413467/cti · [email protected]https://www.totolink.net/ · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 05 OCT 09:30Z
    Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
    cvelistv5
  • 05 OCT 09:30Z
    Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
    cvelistv5