CVE-2026-34026: Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files

Synopsis

A path traversal vulnerability in Wertheim SafeController Software (AssemblyVersion 6.15.8328.28014) allows any authenticated user, regardless of role, to download arbitrary files from the host by manipulating the documentName parameter in the /safe/selfservice/openselfservicedocument endpoint. The application builds a file path from attacker-controlled input without adequate validation, so an attacker who holds even the lowest-privilege account can walk outside the intended document directory and retrieve any file the application process can read. No fix version has been published; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS to send a crafted request.

• AuthenticationRequired

  Any low-privilege account is sufficient; the vulnerability is not restricted to administrative or elevated roles.

• Victim interactionNot required

  No victim action is needed; the attacker sends the malicious request directly without requiring another user to interact.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or specific environmental setup beyond network access and valid credentials.

Blast Radius

• Reads arbitrary files accessible to the application process, including configuration files that may contain database credentials, API keys, or internal hostnames.
• Retrieves application log files that can contain session tokens, usernames, and audit trail data for the safe-deposit locker system.
• Downloads application binaries, enabling an attacker to reverse-engineer proprietary logic or identify further vulnerabilities offline.
• Exposes any operating-system-level files readable by the application account, such as /etc/passwd or service account key files stored on the host.