# CVE-2026-112350: Sunhillo SureLine path traversal in radarUpdater.cgi

Source: https://junglewise.ai/threats/cve-2026-112350-sunhillo-sureline-before-9-1-5-contains-a-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-112350 · Severity: high · CVSS 7.5 · Published 2026-10-27

Sunhillo SureLine is a weather radar and severe weather alert platform used by emergency management and broadcast organizations. An unauthenticated attacker can read arbitrary files on the system, including cryptographic keys and credential databases, by exploiting missing authentication and path validation in the radarUpdater.cgi endpoint. This could lead to complete system compromise and exposure of sensitive data across connected infrastructure.

Technologies: [Sunhillo Sureline](https://junglewise.ai/threats/technologies/sureline). Vendors: [Sunhillo](https://junglewise.ai/threats/vendors/sunhillo).

## Quick answers

**Is CVE-2026-112350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112350 being exploited in the wild.

**How severe is CVE-2026-112350?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Sunhillo Sureline 8.0.0 through 9.1.4.

**Is there a fix for CVE-2026-112350?** Yes: fixed in SureLine 9.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112350 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-112350?** Check whether you run Sunhillo Sureline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SureLine 9.1.5

## Technical details

A path traversal vulnerability in the radarUpdater.cgi endpoint allows unauthenticated remote attackers to bypass file access restrictions using directory traversal sequences (e.g., ../) in the filename parameter. The endpoint lacks both authentication checks and proper input sanitization, enabling attackers to read arbitrary files with root privileges. Exploitation can yield sensitive system files including /etc/shadow, SSH private keys, TLS certificates, and web application databases.

## Affected products

- Sunhillo SureLine 8.0.0 through 9.1.4

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.sunhillo.com/product/sureline/](https://www.sunhillo.com/product/sureline/)
- [https://www.vulncheck.com/advisories/sunhillo-sureline-path-traversal-via-radarupdater-cgi](https://www.vulncheck.com/advisories/sunhillo-sureline-path-traversal-via-radarupdater-cgi)

## Related threats

- [Sunhillo SureLine authentication bypass via session cookie](https://junglewise.ai/threats/cve-2026-112352-sunhillo-sureline-before-9-1-5-contains-an-authentication-bypass)
- [Sunhillo SureLine OS command injection in networkDiag.cgi](https://junglewise.ai/threats/cve-2026-112351-sunhillo-sureline-before-9-1-5-contains-an-os-command-injection)
- [Sunhillo SureLine OS Command Injection Vulnerablity](https://junglewise.ai/threats/cve-2021-36380-sunhillo-sureline-os-command-injection-vulnerablity)