Path traversal in PUPnP - #VU159571
Published: November 6, 2026
Vulnerability identifier: #VU159571
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read files outside the configured document root.
The vulnerability exists due to incomplete path normalization in PUPnP's built-in web server on Windows when an application configures a document root, allowing encoded backslashes to bypass traversal checks. An unauthenticated remote attacker can send an HTTP request containing /..%5csecret.txt to the reachable server to retrieve files outside that root that the server process can read.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.1.8