CVE-2026-41551: Siemens ROS# path traversal in file_server

CVE-2026-41551 · Severity: critical · CVSS 9.1 · Published 2026-05-12

Siemens ROS# is a library used to integrate ROS (Robot Operating System) with .NET applications, commonly used in industrial automation and manufacturing. A security flaw in its file server component allows an attacker to remotely read or write sensitive files on the host system. This could lead to the theft of proprietary data or the unauthorized modification of system configurations, potentially disrupting manufacturing operations.

Vendors: Siemens.

Quick answers

Is CVE-2026-41551 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41551 being exploited in the wild.
How severe is CVE-2026-41551?
Critical severity, with a CVSS score of 9.1, published 12 May 2026.
Which products and versions are affected?
Siemens ROS# < 2.2.2, All versions < V2.2.2.
Is there a fix for CVE-2026-41551?
A patch was published on 2026-05-12: Version 2.2.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41551 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41551?
Check whether you run Siemens ROS# at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A relative path traversal vulnerability (CWE-23) exists in the file_server service of Siemens ROS# before version 2.2.2. The vulnerability stems from insufficient sanitization of user-provided input used in file operations. A remote, unauthenticated attacker can exploit this by sending specially crafted requests to the service to access or overwrite files outside of the intended directory, limited only by the permissions of the user account running the service. This can result in full compromise of data confidentiality and integrity on the host system. Siemens has released version 2.2.2 to address this issue.

Affected products

  • Siemens ROS# (ros-sharp) < 2.2.2

Timeline

  • 2026-05-12: advisory: Initial Siemens ProductCERT advisory (SSA-357982) published
  • 2026-05-14: advisory: CISA ICSA-26-134-08 published
  • 2026-05-12: patched: Version 2.2.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.