Read the docs
TI-2025-27677 Aliases CVE-2025-41714GHSA-8cjm-642p-wq8x

Path Traversal via 'Upload-Key' in SmartEMS Upload Handling

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00709 53rd percentileScored 2026-11-07
Fix Fixed SmartEMS Web Application (Welotec): v3.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecSmartEMS Web Applicationv0.0.0 to before v3.3.6v3.3.6Patch availableCNA
  • SmartEMS Web Application VendorWelotec Affected v0.0.0 to before v3.3.6 Fixed in v3.3.6 Patch available CNA

Remediation

  • Fix · CNA SmartEMS Web Application (Welotec) Fixed in v3.3.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41714
  2. 2026-10-03 Alias added: GHSA-8cjm-642p-wq8x

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
  • TI-2026-84179 Command injection in Welotec WireGuard VPN function CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences