Executive brief
Scada-LTS is a SCADA (supervisory control and data acquisition) system used to monitor and manage industrial infrastructure. The project import feature contains a path traversal flaw that allows authenticated administrators to write malicious files outside their intended directories. An attacker could overwrite application assets to deface the UI, inject malicious code for cross-site scripting attacks, or modify configuration files—affecting all operators who access the system.
Technical details
The vulnerability is a Zip Slip path traversal flaw in the ZIPProjectManager.restoreFiles method (br/org/scadabr/vo/exporter/ZIPProjectManager.java). During ZIP archive import, the code fails to properly validate ZIP entry names before writing files to disk. The PathSecureUtils.toSecurePath function simply concatenates untrusted entry names (e.g., "uploads/../../../../webapps/Scada-LTS/assets/logo.png") to the base directory without canonicalizing or stripping traversal sequences, allowing writes anywhere beneath Common.getHomeDir(). The vulnerability requires authentication as an administrator and is triggered by uploading a crafted ZIP archive via the System → Import interface. Successful exploitation enables arbitrary file overwrite, leading to UI defacement, persistent XSS injection via malicious SVGs, or modification of application resources. A public proof-of-concept exists, and the vendor has not responded to early disclosure.
Affected products
- Scada-LTS Scada-LTS up to 2.7.8.1
Timeline
- 2025-11-30: disclosed
- other: Public exploit proof-of-concept available