{"affected":[{"defaultStatus":"unaffected","packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFF6","source":"CNA: Zenitel","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8","source":"CNA: Zenitel","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MP","source":"CNA: Zenitel","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MN","source":"CNA: Zenitel","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFT","source":"CNA: Zenitel","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]}],"cveId":"CVE-2026-95378","cwes":["CWE-22","CWE-434"],"description":"Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: Zenitel","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P","version":"4.0"},{"score":8.6,"severity":"high","source":"NVD: cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794600238215,"publishedAt":1794584714968,"references":[{"source":"CNA: Zenitel","tags":[],"url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"},{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","tags":[],"url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"remediation":[{"kind":"fix","source":"CNA: Zenitel","text":"Affected devices should upgrade to version 10.1.3.0 (and newer)."}],"revision":"23da425222fe58c233a45dc6feab3dcb6311ea16213a4ed8ded8e2e0e46c62ed","sources":[{"modifiedAt":1794600238215,"name":"CNA: Zenitel","retrievedAt":1794604229500,"url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"},{"modifiedAt":1794586777510,"name":"NVD","retrievedAt":1794594112543,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95378"}],"ssvc":{"assessedAt":1794599546219,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root","updatedAt":1794604229500}