Path traversal in Siemens Teamcenter Active Workspace V4.3
Priority LOW 34CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Teamcenter Active Workspace V5.1 (All versions < V5.1.6), Teamcenter Active Workspace V5.2 (All versions < V5.2.3). The application contains an unsafe unzipping pattern that could lead to a zip path traversal attack. This could allow and attacker to execute a remote shell with admin rights.
Why it matters now
EPSS 0.01086 65th percentileScored 2026-11-07
Fix Fixed Teamcenter Active Workspace V4.3 (Siemens): V4.3.11Teamcenter Active Workspace V5.0 (Siemens): V5.0.10+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Teamcenter Active Workspace V4.3 | before V4.3.11 | V4.3.11 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.0 | before V5.0.10 | V5.0.10 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.1 | before V5.1.6 | V5.1.6 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.2 | before V5.2.3 | V5.2.3 | Patch available | CNA |
- Teamcenter Active Workspace V4.3 VendorSiemens Affected before V4.3.11 Fixed in V4.3.11 Patch available CNA
- Teamcenter Active Workspace V5.0 VendorSiemens Affected before V5.0.10 Fixed in V5.0.10 Patch available CNA
- Teamcenter Active Workspace V5.1 VendorSiemens Affected before V5.1.6 Fixed in V5.1.6 Patch available CNA
- Teamcenter Active Workspace V5.2 VendorSiemens Affected before V5.2.3 Fixed in V5.2.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:teamcenter_active_workspace:*:*:*:*:*:*:*:* | 4.3 to before 4.3.11; 5.0 to before 5.0.10; 5.1 to before 5.1.6; 5.2 to before 5.2.3 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:teamcenter_active_workspace:*:*:*:*:*:*:*:* Versions 4.3 to before 4.3.11; 5.0 to before 5.0.10; 5.1 to before 5.1.6; 5.2 to before 5.2.3 Vulnerable ·Siemens
Remediation
- Fix · CNA Teamcenter Active Workspace V4.3 (Siemens) Fixed in V4.3.11
- Fix · CNA Teamcenter Active Workspace V5.0 (Siemens) Fixed in V5.0.10
- Fix · CNA Teamcenter Active Workspace V5.1 (Siemens) Fixed in V5.1.6
- Fix · CNA Teamcenter Active Workspace V5.2 (Siemens) Fixed in V5.2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41547
- 2026-10-03 Alias added: GHSA-x4wg-w7pm-7f26
References
More Siemens Teamcenter Active Workspace vulnerabilities
- TI-2022-13880 Cross-site scripting in Siemens Teamcenter Active Workspace V5.2 CVSS 3.1MEDIUM 6.1
- TI-2021-13084 Cross-site scripting in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 6.1
- TI-2021-17428 Path traversal in Siemens Teamcenter Active Workspace V4.3 CVSS 3.1MEDIUM 4.9
- TI-2021-13085 Information disclosure through error messages in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 5.3
- TI-2021-13083 Information disclosure in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-41547 · CVE Program
- CVE-2021-41547 · NVD
- FIRST EPSS
- GHSA-x4wg-w7pm-7f26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences