Description
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | PowerChute™ Serial Shutdown | Versions 1.4 and prior | — |
Advisories 2
- ICSA-26-190-02 Schneider Electric PowerChute Serial Shutdown CISA ICS & IT advisories · Jul 9, 2026
- SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute™ Serial Shutdown Schneider Electric CPCERT · Apr 14, 2026