CVE-2026-12339CWE-22path-traversal

CVE-2026-12339

published August 10, 2026

CVSS
6.9
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

A Zip Slip vulnerability in the WebUI ISP

Upgrade functionality allows arbitrary file write via a crafted archive

containing directory traversal sequences. An authenticated administrator may

overwrite arbitrary files on the system.Successful

exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-10T23:17Z
References (8)
https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/faq/5237/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 10 AUG 18:20Z
    Authenticated Arbitrary File Write Vulnerability in multiple devices
    cvelistv5