Arbitrary file read in Innotim Software's Logsign SIEM
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Logsign SIEM from 6.4.120 before 6.4.122, from Innotim Software, Telecommunications, and Consulting Co. Ltd., contains a path traversal flaw (CWE-22) that lets input escape a restricted directory. An attacker with low privileges can read arbitrary files over the network, with high confidentiality impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Innotim Software, Telecommunications, and Consulting Co. Ltd. | Logsign SIEM | 6.4.120 to before 6.4.122 | 6.4.122 | Patch available | CNA |
- Logsign SIEM VendorInnotim Software, Telecommunications, and Consulting Co. Ltd. Affected 6.4.120 to before 6.4.122 Fixed in 6.4.122 Patch available CNA
Remediation
Upgrade Logsign SIEM to version 6.4.122 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Logsign SIEM (Innotim Software, Telecommunications, and Consulting Co. Ltd.) Fixed in 6.4.122
Timeline
- 2026-10-26 Threatist record created from CVE-2026-105947
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-pg99-7cpg-92c9
References
Sources
- CVE-2026-105947 · CVE Program
- CVE-2026-105947 · NVD
- FIRST EPSS
- GHSA-pg99-7cpg-92c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences