Description

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-17T14:20:20.920Z",
  "pubdate": "2026-08-17T14:20:20.920Z",
  "executiveSummary": "Dell ObjectScale, in versions prior to 4.3.0.1, suffers from a critical Path Traversal vulnerability that exposes the system to unauthorized information disclosure risks. This security flaw originates from improper input validation within the affected product, allowing unauthorized retrieval of arbitrary files from the underlying filesystem. The vulnerability presents a tangible risk to confidentiality, potentially exposing sensitive configuration data, system files, or proprietary information stored within the host environment. Exploitation of this security issue is restricted to low-privileged threat actors possessing local access to the target system. While remote exploitation is not facilitated by this specific attack vector, an authenticated local user can leverage directory traversal sequences to bypass access controls and traverse outside the intended application boundaries. The overall risk implication is moderate to high depending on the sensitivity of the exposed files and the system hardening posture. Remediation requires updating the affected Dell ObjectScale software to version 4.3.0.1 or later, where the input sanitization routines and directory boundary enforcement mechanisms have been properly addressed by the vendor.",
  "technicalDetails": "The identified vulnerability is a Path Traversal flaw residing in Dell ObjectScale versions prior to 4.3.0.1. The root cause of the issue stems from the application's failure to adequately sanitize and validate user-supplied input used in file system operations. Specifically, the vulnerable component fails to properly filter directory traversal sequences such as dot-dot-slash (../) strings within parameters or requests processed by the application.\nThe attack flow requires an adversary to possess local access to the target host and low-privileged user capabilities. To initiate exploitation, the attacker crafts a malicious request or input string containing relative path sequences designed to escape the designated working directory or document root. When the vulnerable component processes this unsanitized input, it resolves the path dynamically, navigating upward through the directory tree to reference arbitrary files located outside the intended administrative boundary.\nUpon successful traversal, the underlying file system honors the relative path resolution, granting the process read access to target files that should otherwise be restricted based on the user's low privilege level. The resulting payload behavior leads directly to information disclosure, as the contents of the targeted system files are returned to the attacker through the application interface or local output channels. The post-exploitation impact is strictly bound to read-only confidentiality breaches, lacking inherent remote code execution or privilege escalation capabilities unless leaked configuration files contain sensitive credentials or cryptographic material that can be leveraged in subsequent attacks. Authentication requirements are minimal, necessitating only standard low-privileged local user credentials to interact with the vulnerable component locally."
}