CVE-2026-35079: Arbitrary file delete vulnerability in method ugw-restore
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the ugw-restore method if it is not required to prevent remote users from invoking it to delete local files.
ugw-restore enabled = false - Configuration
Ensure the ugw-restore method performs strict server-side validation and sanitization of all user-controlled input (for example, disallow path traversal and restrict allowed file paths) before performing any file operations.
ugw-restore input_validation = enabled - Compensating control
Restrict access to the ugw-restore functionality: limit which user accounts have the privilege to invoke it and block access to the management/restore endpoint from untrusted networks using firewall rules or ACLs (allow only trusted administrative IPs).
- Operational
Investigate systems for unauthorized or unexpected file deletions, restore affected files from backups as needed, review logs to determine if exploitation occurred, and rotate credentials if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35079?
CVE-2026-35079 has a severity rating of 7.2, indicating high risk.
What does CVE-2026-35079 allow an attacker to do?
CVE-2026-35079 allows a remote attacker with user privileges to delete arbitrary local files on the affected system.
How do I fix CVE-2026-35079?
To fix CVE-2026-35079, ensure proper validation of user input in the ugw-restore method to prevent unauthorized file deletions.
Which software is affected by CVE-2026-35079?
CVE-2026-35079 affects the Mbs-solutions Universal Gateway Firmware.
When was CVE-2026-35079 published?
CVE-2026-35079 was published on June 3, 2026.