Read the docs
TI-2026-00446 Aliases CVE-2026-0651GHSA-c348-hjj9-x39v

Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed Tapo C260 v1 (TP-Link Systems Inc.): 1.1.9 Build 251226 Rel.55870nTapo D235 v1 (TP-Link Systems Inc.): 1.2.2 Build 260210 Rel.27165n+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C260 v1before 1.1.9 Build 251226 Rel.55870n1.1.9 Build 251226 Rel.55870nPatch availableCNA
TP-LinkTapo D235 v1before 1.2.2 Build 260210 Rel.27165n1.2.2 Build 260210 Rel.27165nPatch availableCNA
TP-LinkTapo C520WS v2.6before 1.2.4 Build 260326 Rel.24666n1.2.4 Build 260326 Rel.24666nPatch availableCNA
TP-LinkTapo C211 v2before 1.5.4 Build 260702 Rel.7078n1.5.4 Build 260702 Rel.7078nPatch availableCNA
  • Tapo C260 v1 VendorTP-Link Affected before 1.1.9 Build 251226 Rel.55870n Fixed in 1.1.9 Build 251226 Rel.55870n Patch available CNA
  • Tapo D235 v1 VendorTP-Link Affected before 1.2.2 Build 260210 Rel.27165n Fixed in 1.2.2 Build 260210 Rel.27165n Patch available CNA
  • Tapo C520WS v2.6 VendorTP-Link Affected before 1.2.4 Build 260326 Rel.24666n Fixed in 1.2.4 Build 260326 Rel.24666n Patch available CNA
  • Tapo C211 v2 VendorTP-Link Affected before 1.5.4 Build 260702 Rel.7078n Fixed in 1.5.4 Build 260702 Rel.7078n Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*before 1.1.9VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*1Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:* Versions before 1.1.9 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:* Versions 1 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C260 v1 (TP-Link Systems Inc.) Fixed in 1.1.9 Build 251226 Rel.55870n
  • Fix · CNA Tapo D235 v1 (TP-Link Systems Inc.) Fixed in 1.2.2 Build 260210 Rel.27165n
  • Fix · CNA Tapo C520WS v2.6 (TP Link Systems Inc.) Fixed in 1.2.4 Build 260326 Rel.24666n
  • Fix · CNA Tapo C211 v2 (TP Link Systems Inc.) Fixed in 1.5.4 Build 260702 Rel.7078n

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Tapo C260 v1, Tapo D235 v1 — tp-link.com/us/support/faq/4960

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-00447 Remote Code Execution on TP-Link Tapo C260 by Guest UserPriority MEDIUM 60
    • TI-2026-00448 Insecure Access Control on TP-Link Tapo D235 and C260Priority LOW 32
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0651
  2. 2026-10-03 Alias added: GHSA-c348-hjj9-x39v

References

Patch 7

Advisory 1

  • TI-2026-00447 Remote Code Execution on TP-Link Tapo C260 by Guest User CVSS 4.0HIGH 8.7
  • TI-2026-00448 Insecure Access Control on TP-Link Tapo D235 and C260 CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences