Back to overview

CVE-2026-9108

MEDIUM
5.4
CVSS 4.0
Description
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

Metadata

CVE ID
CVE-2026-9108
State
PUBLISHED
Assigner
Rockwell
Reserved
2026-05-20 17:20 UTC
Published
2026-07-14 15:09 UTC
Last updated
2026-07-14 15:54 UTC
Primary CWE
CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product
Rockwell Automation / Studio 5000 Logix Designer
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 4.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Rockwell Automation Studio 5000 Logix Designer — V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older
Weakness (CWE)
CWESourceDescription
CWE-22 cna CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (1)
Back to overview