Executive brief
Wertheim SafeController is a software platform used by banks and financial institutions to manage safe deposit boxes and vault rooms. A security flaw allows an authorized user to bypass folder restrictions and download sensitive files from the server that they should not have access to. This could lead to the exposure of system logs containing sensitive data or the theft of application files, potentially helping an attacker gain further control over the vault management system.
Technical details
A path traversal vulnerability (CWE-23) exists in the Wertheim SafeController Software, specifically within the 'documentName' parameter of the '/safe/selfservice/openselfservicedocument' endpoint. The application fails to sufficiently validate user-supplied input before using it to construct file paths. An authenticated attacker, regardless of their assigned role or permission level, can use traversal sequences (e.g., ../) to escape the intended document directory. This allows for the unauthorized download of any files accessible to the application service account, including sensitive log files and application binaries. When combined with other vulnerabilities in the suite, this can contribute to a full remote code execution (RCE) chain.
Affected products
- Wertheim SafeController Software AssemblyVersion 6.15.8328.28014
Timeline
- 2023-04-03: other: Vulnerability discovered by SEC Consult Vulnerability Lab
- 2026-06-15: advisory: Public disclosure of CVE-2026-34026