CVE-2026-9775
Description
ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28503.
Summary dbcve.org
ATEN Unizon contains a directory traversal vulnerability in the uploadSSL method due to insufficient validation of user-supplied paths before file operations. An authenticated attacker can manipulate path traversal sequences (e.g., ../../) to delete arbitrary files on the host system or cause denial of service.
Mitigation
Implement strict path validation to ensure file operations are restricted to authorized directories; validate and sanitize all user-supplied path inputs, canonicalize paths, and reject traversal sequences.