CVE-2026-49009CWE-22path-traversal

CVE-2026-49009

Low · published May 28, 2026

CVSS v3.1
3.1
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-28T00:16Z
References (2)
https://mender.io/blog/cve-2026-49009-cve-2026-33552-input-sanitization-and-access-control-issues-in-mender-server · [email protected]https://northern.tech · [email protected]
EPSS history
Timeline
  • 27 MAY 00:00Z
    Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal
    cvelistv5