# CVE-2026-0651: TP-Link Tapo camera path traversal in HTTP server

Source: https://junglewise.ai/threats/cve-2026-0651-tp-link-tapo-camera-path-traversal-in-http-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-0651 · Severity: high · CVSS 7.8 · Published 2026-02-10

TP-Link Tapo security cameras (C260, D235, C211, C520WS) contain a path traversal flaw in their HTTP server that allows attackers to access files outside the intended directories. Authenticated attackers can extract sensitive system files and credentials, while unauthacated attackers can reach static assets. This puts customer data and camera configurations at risk of compromise.

Technologies: [TP-Link Tapo C520WS](https://junglewise.ai/threats/technologies/tapo-c520ws). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-0651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0651 being exploited in the wild.

**How severe is CVE-2026-0651?** High severity, with a CVSS score of 7.8, published 10 February 2026.

**Which products and versions are affected?** TP-Link Tapo C211 v2; TP-Link Tapo C520WS v2.6; TP-Link Tapo D235 v1; TP-Link Tapo C260 v1.

**Is there a fix for CVE-2026-0651?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0651 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-0651?** Check whether you run TP-Link Tapo C211, TP-Link Tapo C520WS, TP-Link Tapo D235 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the HTTP server's handling of GET requests across multiple Tapo camera models. The server performs path normalization before fully decoding URL-encoded input and falls back to the raw path when normalization fails, allowing attackers to bypass directory restrictions using crafted, URL-encoded traversal sequences. Authenticated users can disclose sensitive system files and credentials; unauthenticated attackers can access non-sensitive static assets. Network access to the camera's HTTP server is required; no user interaction is needed once the request is crafted. Patches are expected from TP-Link for the affected firmware versions.

## Affected products

- TP-Link Tapo C260 v1
- TP-Link Tapo D235 v1
- TP-Link Tapo C211 v2
- TP-Link Tapo C520WS v2.6

## Timeline

- 2026-02-10: disclosed

## References

- [https://www.tp-link.com/en/support/download/tapo-c211/v2/](https://www.tp-link.com/en/support/download/tapo-c211/v2/)
- [https://www.tp-link.com/en/support/download/tapo-c260/v1/](https://www.tp-link.com/en/support/download/tapo-c260/v1/)

## Related threats

- [TP-Link Tapo C520WS format string vulnerability in ONVIF Subscribe service](https://junglewise.ai/threats/cve-2026-6242-tp-link-tapo-c520ws-format-string-vulnerability-in-onvif-subscribe)
- [TP-Link Tapo C520WS format string vulnerability in ONVIF AddScopes](https://junglewise.ai/threats/cve-2026-6241-tp-link-tapo-c520ws-format-string-vulnerability-in-onvif-addscopes)
- [TP-Link Tapo C520WS stack overflow in ONVIF DeleteUsers service](https://junglewise.ai/threats/cve-2026-6240-tp-link-tapo-c520ws-stack-overflow-in-onvif-deleteusers-service)
- [TP-Link Tapo C520WS stack buffer overflow in ONVIF CreateUsers service](https://junglewise.ai/threats/cve-2026-6239-tp-link-tapo-c520ws-stack-buffer-overflow-in-onvif-createusers)
- [TP-Link Tapo C520WS auth bypass in API authorization mechanism](https://junglewise.ai/threats/cve-2026-34123-tp-link-tapo-c520ws-auth-bypass-in-api-authorization-mechanism)