VulnerabilityDeferred

CVE-2026-4233

A vulnerability was identified in ThingsGateway 12.

LOW 2.1EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was identified in ThingsGateway 12. This affects an unknown part of the file /api/file/download. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: cna@vuldb.com

References

https://github.com/SourByte05/SourByte-Lab/issues/11
https://vuldb.com/?ctiid.351156
https://vuldb.com/?id.351156
https://vuldb.com/?submit.771234

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.