# CVE-2026-31927: Anviz CX7 Firmware path traversal via CSV upload

Source: https://junglewise.ai/threats/cve-2026-31927-anviz-cx7-firmware-path-traversal-via-csv-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-17. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-31927 · Severity: medium · CVSS 4.9 · Published 2026-04-17

Anviz CX7 facial recognition and time attendance devices are affected by a security flaw in how they handle file uploads. An authorized user with high-level permissions can exploit this to overwrite critical system files, which could allow them to gain full administrative control (root access) over the device. This could lead to unauthorized access to the building or tampering with employee time records.

Technologies: [Anviz Cx7](https://junglewise.ai/threats/technologies/cx7), [Anviz Cx7 Firmware](https://junglewise.ai/threats/technologies/cx7-firmware). Vendors: [Anviz](https://junglewise.ai/threats/vendors/anviz).

## Quick answers

**Is CVE-2026-31927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31927 being exploited in the wild.

**How severe is CVE-2026-31927?** Medium severity, with a CVSS score of 4.9, published 17 April 2026.

**Which products and versions are affected?** Anviz Cx7 Firmware All versions.

**Is there a fix for CVE-2026-31927?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31927 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-31927?** Check whether you run Anviz Cx7 or Anviz Cx7 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Anviz CX7 firmware contains a relative path traversal vulnerability (CWE-23) within its CSV upload functionality. An authenticated attacker with high privileges can craft a malicious CSV upload to overwrite arbitrary files on the local filesystem, such as /etc/shadow. When combined with other vulnerabilities that allow modifying debug settings to enable SSH, this flaw enables an attacker to gain unauthorized root-level SSH access to the device. As of the advisory date, the vendor has not responded to coordination attempts, and no official patch is available.

## Affected products

- Anviz CX7 Firmware All versions

## Timeline

- 2026-04-16: advisory: CISA ICSA-26-106-03 published
- 2026-04-17: disclosed: CVE-2026-31927 published to NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json)
- [https://www.anviz.com/contact-us.html](https://www.anviz.com/contact-us.html)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03)

## Related threats

- [Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling…](https://junglewise.ai/threats/cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post)
- [Anviz CX2 Lite and CX7 remote code execution via unverified updates](https://junglewise.ai/threats/cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified)
- [Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be…](https://junglewise.ai/threats/cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware)
- [Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without…](https://junglewise.ai/threats/cve-2026-35061-anviz-cx7-firmware-is-vulnerable-to-the-most-recently-captured)
- [Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and…](https://junglewise.ai/threats/cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http)