Remote Code Execution Vulnerability in Affected Product by Vendor

CVE-2026-14947

What is CVE-2026-14947?

This vulnerability allows an authenticated attacker with high privileges to upload malicious ZIP archives containing directory traversal sequences, such as ../, which can escape the intended extraction directory. This flaw results from improper validation of archive entry paths prior to writing files to disk. By exploiting this vulnerability, attackers may succeed in writing files to arbitrary locations on the server, potentially leading to arbitrary code execution and compromising the entire system.

References