CVE-2026-76158CWE-73

CVE-2026-76158

published August 21, 2026

CVSS

9.3

EPSS

Percentile

43.4

In the wild

Unconfirmed

What it is

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.

The record

Technical detail

CVSS: 9.3 · NONE
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
EPSS: 0.00521 · 43.4th percentile
Weakness: CWE-73 · External Control of File Name or Path
Published: 2026-08-21T07:16Z

References (1)

https://zuso.ai/advisory · [email protected]

EPSS history

Timeline

21 AUG 02:02Z
Datiphy Data Management Center - External Control of File Name or Path
cvelistv5