# CVE-2026-12339: TP-Link Archer MR router ISP upgrade Zip Slip arbitrary file write

Source: https://junglewise.ai/threats/cve-2026-12339-tp-link-archer-mr-router-isp-upgrade-zip-slip-arbitrary-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12339 · Severity: info · Published 2026-08-10

TP-Link Archer MR routers provide 4G/LTE connectivity and Wi-Fi for home and business networks. The web-based ISP file upgrade feature is vulnerable to a Zip Slip attack, allowing an authenticated administrator to upload a specially crafted archive that overwrites arbitrary files on the device, compromising system integrity and availability.

Technologies: [TP-Link Archer MR600](https://junglewise.ai/threats/technologies/archer-mr600). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-12339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12339 being exploited in the wild.

**How severe is CVE-2026-12339?** Informational severity, published 10 August 2026.

**Which products and versions are affected?** TP-Link Archer MR200 multiple versions including V5, V6, V7; TP-Link Archer MR600 multiple versions including V2, V3, V5.

**Is there a fix for CVE-2026-12339?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12339 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12339?** Check whether you run TP-Link Archer MR200 or TP-Link Archer MR600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Zip Slip vulnerability exists in the WebUI ISP upgrade functionality that fails to properly validate directory traversal sequences in archive entries. An authenticated administrator can craft a malicious ZIP file containing paths with traversal sequences (e.g., ../../../etc/config) to write files outside the intended extraction directory. The vulnerability is exploitable only by authenticated users with administrator access to the web interface. Successful exploitation allows overwriting critical system files, potentially leading to configuration tampering, service disruption, or system compromise. No patch information is currently available in the advisory.

## Affected products

- TP-Link Archer MR200 multiple versions including V5, V6, V7
- TP-Link Archer MR600 multiple versions including V2, V3, V5

## Timeline

- 2026-08-10: disclosed

## References

- [https://www.tp-link.com/en/support/download/archer-mr200/v7/](https://www.tp-link.com/en/support/download/archer-mr200/v7/)
- [https://www.tp-link.com/en/support/download/archer-mr600/v2/](https://www.tp-link.com/en/support/download/archer-mr600/v2/)

## Related threats

- [TP-Link Archer MR600 and TL-MR6400 authentication bypass in VPN configuration](https://junglewise.ai/threats/cve-2026-76653-tp-link-archer-mr600-and-tl-mr6400-authentication-bypass-in-vpn)
- [TP-Link Archer MR600 and TL-MR6400 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-76652-tp-link-archer-mr600-and-tl-mr6400-directory-traversal-in-file)
- [TP-Link 4G/LTE router denial of service via malformed HTTP request](https://junglewise.ai/threats/cve-2026-8619-tp-link-4g-lte-router-denial-of-service-via-malformed-http-request)
- [TP-Link Multiple Routers hardcoded credentials in firmware](https://junglewise.ai/threats/cve-2026-12001-tp-link-multiple-routers-hardcoded-credentials-in-firmware)
- [TP-Link Archer MR600 command injection in WireGuard configuration](https://junglewise.ai/threats/cve-2026-8913-tp-link-archer-mr600-command-injection-in-wireguard-configuration)