# CVE-2026-6865: Schneider Electric path traversal in server-side file processing

Source: https://junglewise.ai/threats/cve-2026-6865-schneider-electric-path-traversal-in-server-side-file-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6865 · Severity: info · CVSS 7.1 · Published 2026-05-12

A path traversal vulnerability has been identified in a Schneider Electric product. This flaw allows an authenticated user to bypass security restrictions and access sensitive files stored on the system. Such an exploit could lead to the exposure of confidential configuration data or system credentials, potentially compromising the integrity of industrial operations.

Vendors: [Schneider Electric](https://junglewise.ai/threats/vendors/schneider-electric).

## Quick answers

**Is CVE-2026-6865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6865 being exploited in the wild.

**How severe is CVE-2026-6865?** Informational severity, with a CVSS score of 7.1, published 12 May 2026.

**Which products and versions are affected?** Schneider Electric Unknown Product.

**Is there a fix for CVE-2026-6865?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6865 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6865?** Check whether you run Schneider Electric Unknown Product. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in a Schneider Electric component due to improper limitation of user-supplied input during server-side file path processing. An attacker with low-level authenticated access can exploit this by submitting specially crafted requests containing directory traversal sequences (e.g., ../). Successful exploitation allows the attacker to read sensitive files outside of the intended directory and potentially modify certain files, as indicated by the CVSS VI:L (Low Integrity impact) rating. The vulnerability is reachable over the network and does not require user interaction.

## Affected products

- Schneider Electric Unknown Product

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory: Advisory SEVD-2026-132-03 published by Schneider Electric

## References

- [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-03.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-03.pdf)