Description

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T20:16:50.727Z",
  "pubdate": "2026-09-13T20:16:50.727Z",
  "executiveSummary": "An absolute path traversal vulnerability exists in Zettlab D6 Ultra versions prior to 1.7.0. This security flaw allows an authenticated or unauthenticated attacker to bypass intended directory restrictions and access arbitrary files or folders outside of the designated personal user directory. The vulnerability stems from improper validation of user-supplied input used in file system operations. Successful exploitation enables unauthorized data access, potentially exposing sensitive system information or configuration files to malicious actors. The impact of this vulnerability is significant, as it violates the principle of least privilege by granting read access to restricted areas of the host file system. There are no indications that this flaw requires complex prerequisites; however, it relies on the application's failure to sanitize input paths containing directory traversal sequences or absolute path identifiers before performing server-side file operations.",
  "technicalDetails": "The vulnerability resides in the file handling mechanisms of Zettlab D6 Ultra versions earlier than 1.7.0. The root cause is the application's failure to properly sanitize user-supplied input when defining the target path for file retrieval or navigation operations. Specifically, the application does not adequately restrict input to the intended personal folder context, allowing the inclusion of absolute path identifiers (e.g., leading slashes or drive letters) that force the file system API to resolve paths relative to the system root rather than the application-defined sandbox.\nThe exploitation flow begins when an attacker supplies a malicious string—containing absolute path markers—to the affected input parameter responsible for file or directory navigation. When the backend service processes this request, it incorrectly trusts the user input and concatenates or directly uses the provided path in an underlying system call (such as open, read, or directory traversal functions). Because the application lacks a secondary validation layer to confirm that the resolved path still resides within the user's allocated 'personal folder' directory, the operating system honors the absolute path traversal request.\nAn attacker can leverage this to navigate across the entire server file system. By systematically incrementing or changing the path, an adversary can identify and exfiltrate configuration files, system logs, or private user data stored outside the personal directory context. The lack of robust path normalization or canonicalization routines is the primary driver of this security failure. Because the system performs the file access using the application's execution context, the attacker is granted the same permissions as the Zettlab D6 Ultra service account. Consequently, any file readable by the service account can be accessed and retrieved by the attacker via this path traversal primitive. The vulnerability represents a critical breakdown in input validation and environment isolation, directly resulting in unauthorized information disclosure."
}