Read the docs
TI-2025-19984 Aliases CVE-2025-27127GHSA-9rr2-q86m-gg2c

Unrestricted file upload in Siemens TIA Project-Server

Priority LOW 24CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed TIA Project-Server (Siemens): V2.1.1Totally Integrated Automation Portal (TIA Portal) V19 (Siemens): V19 Update 4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensTIA Project-Serverbefore V2.1.1V2.1.1Patch availableCNA
SiemensTIA Project-Server V17all versions—No fix listedCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V17all versions—No fix listedCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V18all versions—No fix listedCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V19before V19 Update 4V19 Update 4Patch availableCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V20before V20 Update 3V20 Update 3Patch availableCNA
  • TIA Project-Server VendorSiemens Affected before V2.1.1 Fixed in V2.1.1 Patch available CNA
  • TIA Project-Server V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Totally Integrated Automation Portal (TIA Portal) V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Totally Integrated Automation Portal (TIA Portal) V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Totally Integrated Automation Portal (TIA Portal) V19 VendorSiemens Affected before V19 Update 4 Fixed in V19 Update 4 Patch available CNA
  • Totally Integrated Automation Portal (TIA Portal) V20 VendorSiemens Affected before V20 Update 3 Fixed in V20 Update 3 Patch available CNA

Remediation

  • Fix · CNA TIA Project-Server (Siemens) Fixed in V2.1.1
  • Fix · CNA Totally Integrated Automation Portal (TIA Portal) V19 (Siemens) Fixed in V19 Update 4
  • Fix · CNA Totally Integrated Automation Portal (TIA Portal) V20 (Siemens) Fixed in V20 Update 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27127
  2. 2026-10-03 Alias added: GHSA-9rr2-q86m-gg2c

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences