CVE-2026-95378
Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
| CWE | CWE-22 CWE-434 |
| Vendor | zenitel |
| Product | vsff6 |
| Published | Nov 13, 2026 |
Get instant alerts for zenitel vsff6
Be the first to know when new unknown vulnerabilities affecting zenitel vsff6 are published — delivered to Slack, Telegram or Discord.