Summary
A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.
Details
An authenticated attacker with network access to the SmartEMS Web UI can write outside the intended upload directory, overwrite or place files in sensitive locations, escalate to remote code execution depending on filesystem permissions and execution context, and access or modify sensitive data.
Vulnerabilities 1
-
High 8.8
Path Traversal via 'Upload-Key' in SmartEMS Upload Handling
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurat…
Revision history
-
#1.0.1
Changes impact note categorie from details to description
-
#1.0.0
Initial revision.
References
-
Welotec PSIRT
https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy
-
CERT@VDE Security Advisories for Welotec
https://certvde.com/de/advisories/vendor/welotec
-
VDE-2025-085: Welotec: Path Traversal in SmartEMS Upload Handling - HTML
https://certvde.com/en/advisories/VDE-2025-085