Vulnerabilities
Path Traversal in Siemens SIMOVE Fleetmanager & SIPLANT Allows Unauthenticated File Access
A CVE-2026-67367 path‑traversal flaw in Siemens SIMOVE Fleetmanager and SIPLANT lets attackers read arbitrary files via the embedded HTTP server. Versions below 3.1.13, 3.2.4, 3.3.2, 4.0.1 for Fleetmanager and all SIPLANT releases up to 3.1.4 are affected. Update to the latest firmware and restrict HTTP access to protect credentials and secrets.
What Happened
Siemens SIMOVE Fleetmanager and SIPLANT contain a directory‑traversal vulnerability in the embedded HTTP server’s file‑serving endpoint. An unauthenticated attacker can craft requests that bypass path validation and read any file on the underlying operating system.
Affected Products
- SIMOVE Fleetmanager V3.1 < 3.1.13
- SIMOVE Fleetmanager V3.2 < 3.2.4
- SIMOVE Fleetmanager V3.3 < 3.3.2
- SIMOVE Fleetmanager V4.0 < 4.0.1
- SIPLANT V1.7, V2.2, V3.0 (all versions)
- SIPLANT V3.1 < 3.1.4
Impact
Unauthenticated remote attackers can read arbitrary files, potentially exposing credential stores, private keys, and configuration secrets. The CVSS score is 8.6 (Vendor Equipment Vulnerabilities v3).
CVSS: 8.6 – High severity
Mitigation
Update to the latest firmware for each product: Fleetmanager 3.1.13+, 3.2.4+, 3.3.2+, 4.0.1+; SIPLANT 3.1.4+ and all newer releases. If an update is not immediately possible, restrict external access to the HTTP interface, disable the file‑serving endpoint, or apply network segmentation to isolate the devices.
Related vulnerabilities
WordPress CVE-2026-87902 Exploitation: Attackers Writing Malicious Files to Disk
WordPress sites vulnerable to CVE‑2026‑87902 are now being exploited to write arbitrary files that execute shell commands. The flaw, a path‑traversal bug in get_page_template(), allows unauthenticated attackers to achieve remote code execution under specific conditions. Defenders should patch to 7.1.2 or later, verify file integrity, and monitor for suspicious file writes.
Read briefing
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Access
Atlassian has disclosed CVE‑2026‑21589, a critical arbitrary file‑access flaw in self‑hosted Data Center editions of Jira, Confluence, Bitbucket, and other products. The flaw allows unauthenticated attackers to read specific files in the web root if they know the exact path. All versions prior to the listed patches must be updated immediately.
Read briefing
CVE-2026-105727: Path Traversal in Dynamics 365 Business Central Enables Privilege Escalation
Microsoft Dynamics 365 Business Central has a path‑traversal flaw (CVE‑2026‑105727) that lets an authenticated user access files outside the intended directory, potentially raising privileges on the network. The issue affects all current releases of Business Central. Defenders should apply the vendor patch immediately, verify file‑system permissions, and monitor for anomalous file access.
Read briefing
Atlassian Data Center Vulnerability CVE‑2026‑21589 Enables Unauthenticated File Read Across 8 Products
A critical path‑traversal flaw (CVE‑2026‑21589) in eight Atlassian Data Center products allows unauthenticated users to read known files in the web‑application root. The issue is fixed in specific versions; unpatched instances should be taken offline or blocked until upgraded.
Read briefing