Path Traversal Flaw in Sustainable Irrigation Platform by Unknown Vendor
CVE-2026-60114

8.7HIGH

Key Information:

Vendor

Dan-in-ca

Status
Sip
Vendor
CVE Published:
14 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-60114?

The Sustainable Irrigation Platform (SIP) through version 5.2.16 is vulnerable to a path traversal issue that can be exploited by attackers who gain access to the restore functionality. By uploading specially crafted JSON backup files that include unvalidated keys, attackers can write files to arbitrary locations, compromising system integrity. This vulnerability is exacerbated by the default configuration which lacks a required passphrase, or uses the easily guessable default passphrase 'opendoor'. As a result, attackers can manipulate the JSON restore process to create or overwrite files outside the designated data area, posing significant risks to the platform's security.

Affected Version(s)

SIP 0 <= 5.2.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-60114 - Proof of Concept

References

https://www.zeroscience.mk/#/advisories/ZSL-2026-5996
technical-descriptionexploit
https://www.vulncheck.com/advisories/sustainable-irrigati...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anja Ivanovska of Zero Science Lab
.