Vulnerabilities

CVSS

4.3 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Risk score

34.4

Published

2026-06-09

Status

Published

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations.

Weaknesses

CWE-26

Coverage 1

threat-intel

Siemens SINEC INS

This CISA advisory details a critical vulnerability affecting Siemens SINEC INS versions prior to V1.0 SP2 Update 6. The vulnerability stems from improper input sanitization, allowing for command injection, path traversa…

CISA Advisories · Jun 23, 2026 Critical

CVE-2026-46746CVE-2026-46747CVE-2026-46748DEcommand injectionpath traversalpassword cracking

All articles mentioning it

Advisories and references

• cert-portal.siemens.com/productcert/html/ssa-860189.html