Executive brief
Frauscher FDS102 is a railway diagnostic system used to monitor and manage track signaling infrastructure. A high-privileged attacker can upload a specially crafted ZIP file that escapes the intended extraction directory and writes files to arbitrary locations on the server, potentially leading to arbitrary code execution and complete system compromise.
Technical details
This vulnerability is a path traversal flaw (CWE-24) in the ZIP extraction functionality of the FDS102 web interface. The application fails to validate archive entry paths before extracting files to disk, allowing an attacker to include directory traversal sequences such as ../ in ZIP entry names. An attacker with high-level privileges can exploit this to write files outside the intended extraction directory, overwrite critical application files, or place executable code in web-accessible locations. The attack requires authentication with elevated privileges and no user interaction. The vendor released a patch in version 2.14.0.
Affected products
- Frauscher Sensortechnik GmbH FDS102 2.0.0 through 2.13.3
Timeline
- 2026-08-25: disclosed: CVE-2026-14947 published
- 2026: patched: Fixed in FDS102 v2.14.0