CVE-2026-43851: Authenticated Path Traversal Enables Arbitrary File Read (CVSS 8.2)

CVE-2026-43851 is a path traversal vulnerability (CWE-22) that could allow an authenticated attacker to read arbitrary files on the system. It carries a CVSS 4.0 base score of 8.2 (HIGH), requires high-privileged access with no user interaction, and is not listed in CISA’s KEV catalog. It was discovered by Simone Bossi and Raffaele Bova at Nozomi Networks.

The flaw is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’): a file-handling routine builds a filesystem path from attacker-controlled input without neutralizing traversal sequences such as ../ or absolute path markers, so the resolved path escapes the intended directory. The description does not disclose the vulnerable endpoint, parameter, or the exact trigger mechanism – those details are not fully disclosed.

The CVSS 4.0 vector pins down the exploitation shape:

AV:N / AC:L / AT:N – remotely exploitable over a network, low attack complexity, no special conditions required.

PR:H / UI:N – the attacker needs a high-privileged authenticated session; no user interaction is involved.

VC:H – high confidentiality loss on the vulnerable system: arbitrary file read.

SC:H – high confidentiality impact on subsequent systems : files read from the target can expose secrets that unlock other systems, and the scoring explicitly acknowledges this cascade.

VI:N / VA:N / SI:N / SA:N – no direct integrity or availability impact per the vector.

The PR:H requirement makes this a post-authentication bug, not a pre-auth one: an attacker must first hold an account with elevated privileges. That raises the bar, but privileged web interfaces are prime targets once credentials leak or get reused, and an arbitrary file read from that position is a straight path to credential material and configuration secrets.

Affected Software and Versions

The vendor and product fields are not populated in the available data, and no affected version ranges are disclosed. The NVD record links to Advantech’s security advisory page and to a Cyber Security Agency of Singapore (CSA) alert, AL-2026-149; consult those sources for the exact affected product and fixed versions. No version numbers can be stated from the provided data.

Arbitrary file read on the target by an authenticated, high-privileged attacker.

High confidentiality impact on the vulnerable system (VC:H) and on subsequent systems (SC:H) – harvested secrets can enable access elsewhere.

No integrity or availability impact is scored in the vector.

Exploitation Scenario

Illustrative scenario derived from the description and CVSS vector; endpoint and parameter specifics are not disclosed.

An attacker first obtains a high-privileged account on the affected system – through credential leak, reuse, or insider access. From an authenticated session, they supply input containing traversal sequences to a function that resolves file paths from user data. Because the application fails to restrict the resolved pathname to an allowed directory, the operating system resolves a location outside the intended root, and the application returns the contents of an arbitrary file.

Consistent with the SC:H metric, the attacker then goes after high-value files – configuration stores, credential material, key files – whose contents unlock access to other systems in the network. The vector’s VI:N and VA:N scores confirm the read does not modify or disrupt the target; the damage is purely informational, but privileged file reads are exactly how information becomes compromise. Whether the traversal is reached through a download, export, or another file-referencing feature is not fully disclosed.

Detection and Mitigation

Apply the vendor fix; the affected product and fixed versions are published in the Advantech security advisory and CSA alert AL-2026-149 cited below.

Hunt for exploitation: review logs for traversal patterns ( ../ and encoded variants) submitted by authenticated high-privilege sessions.

Defensive coding: canonicalize paths, enforce allowlisted directories, and run file-access services with least privilege.

For programs covering the affected product, treat this as an authenticated path traversal: enumerate every feature that accepts a file path or filename from the user and probe it with traversal payloads while holding a high-privileged test account. Demonstrate impact safely by reading a harmless known file rather than live secrets. The PR:H requirement may cap base severity in some programs, but chaining the read to exposed credentials – the SC:H story – is how you justify a higher impact rating.

Frequently Asked Questions

What is CVE-2026-43851?

A path traversal vulnerability (CWE-22) that could allow an authenticated attacker to read arbitrary files on the system. It is scored 8.2 HIGH under CVSS 4.0, requires high privileges, and has high confidentiality impact on the vulnerable system and subsequent systems.

Is CVE-2026-43851 exploited in the wild?

Per the provided data, it is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and no in-the-wild exploitation is documented. Exploitation requires an authenticated session with high privileges on the affected system.

Discovery and Credits: Discovered by Simone Bossi and Raffaele Bova at Nozomi Networks; CVE assigned by CSA (Cyber Security Agency of Singapore).

Advantech Security Advisories

CSA Alert AL-2026-149

GitHub Advisory GHSA-r28p-486w-5vxc