CVE-2026-95378: Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than httpscertificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zenitel turbinewebto a version that resolves this vulnerability.Fixed in 10.1.3.0
Event History
Frequently Asked Questions
Which systems are affected?
Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices running turbineweb software versions from 10.0.3.0 before 10.1.3.0 are affected.
What access does an attacker need to exploit this issue?
An attacker needs authenticated administrator access to the turbineweb web interface. Exploitation uses a crafted multipart request to /api/certificate/upload.
Is certificate validation sufficient to prevent exploitation?
No. When the upload request's type field is set to a value other than https_certificate, both path validation and certificate-content validation are skipped.
What is the likely impact if the vulnerability is exploited?
An authenticated administrator can write arbitrary files as root. This can be escalated to root-level code execution, including by overwriting startup scripts or adding SSH keys.