CVE-2026-85114: Path Traversal
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
.NET Client Library for SIMATIC S7 Webserver APIto a version that resolves this vulnerability.Fixed in V3.3.61
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using the Siemens .NET Client Library for SIMATIC S7 Webserver API in versions earlier than V3.3.61 are affected.
What must an attacker be able to do to exploit this issue?
The attacker must be able to manipulate the ticket response received by the application during a ticket download. No authentication or user interaction is required according to the supplied CVSS vector.
When can existing files be replaced?
Existing files can be replaced only when overwriting is enabled and the files are accessible to the affected application. The vulnerability also allows writes outside the intended download directory.