Path traversal in PUPnP - #VU159574
Published: November 6, 2026
Vulnerability identifier: #VU159574
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read files outside a configured non-empty document root that the PUPnP web server process can access.
The vulnerability exists due to confinement checks stopping at the first decoded question mark or hash character while the built-in web server opens the entire path. An unauthenticated remote attacker can send traversal requests on Windows, or on other systems when the document root contains a directory whose name includes either character, to disclose file contents.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.1.9