Description

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-17T14:20:21.487Z",
  "pubdate": "2026-08-17T14:20:21.487Z",
  "executiveSummary": "Dell ObjectScale, in versions prior to 4.3.0.1, suffers from a Path Traversal vulnerability that poses significant risks to data integrity and system security. This security flaw enables unauthorized manipulation of data and unauthorized file access, directly resulting in potential information tampering across affected deployments. The vulnerability resides within the application's handling of file system paths, where insufficient input sanitization allows malicious actors to navigate outside the intended directory structure. Exploitation of this vulnerability requires a threat actor to possess low privileges along with local access to the target environment. Although local access is required, the presence of a low-privileged execution context drastically lowers the barrier to exploitation, enabling malicious internal users or compromised accounts to escalate their operational impact. The overarching risk implication involves the compromise of stored data integrity, potentially leading to unauthorized modification, corruption, or substitution of critical system or application files. Organizations utilizing vulnerable iterations of the product must address this exposure promptly to maintain secure object storage operations and prevent unauthorized local manipulation of system data.",
  "technicalDetails": "The identified vulnerability is classified as a Path Traversal flaw affecting Dell ObjectScale in versions prior to 4.3.0.1. The root cause of this security defect stems from inadequate validation, sanitization, and filtering of user-supplied input utilized in file system operations. When the application processes incoming requests containing directory traversal sequences (such as dot-dot-slash patterns), it fails to properly restrict the operational scope to the designated root directory or sandbox environment. This permits low-privileged attackers with local access to traverse the underlying file system hierarchy, reaching restricted directories and files that should otherwise remain inaccessible. The attack flow commences with the authentication of a low-privileged local user session. The malicious actor crafts specialized input incorporating traversal sequences designed to escape the intended directory boundaries. Upon submission, the vulnerable component processes the unsanitized path parameter, allowing the attacker to reference arbitrary file locations outside the intended storage paths. Depending on the exact execution context and file permissions, the attacker can leverage this capability to overwrite, modify, or create unauthorized files, directly achieving information tampering. The privilege requirements for this exploit are constrained to low privileges, meaning an attacker does not require administrative or root access to execute the traversal. Furthermore, the exploitation vector relies on local access rather than direct network exposure, mitigating remote vector threats but remaining a critical risk for scenarios involving multi-tenant environments, compromised local user accounts, or insider threats. Post-exploitation impact centers primarily on information tampering, where malicious alterations to targeted files can disrupt application stability, compromise data reliability, or facilitate further local privilege escalation depending on the targeted system files."
}