CVE-2026-12339

MediumCVSS 6.9/10Last modified Oct 23, 2026

Description

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
TP-Link Systems Inc.TL-MR6400 v5.3< (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n
TP-Link Systems Inc.Archer MR600 v2< (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
TP-Link Systems Inc.Archer MR200 v7< (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n
TP-Link Systems Inc.TL-MR6400 v8.0< (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
TP-Link Systems Inc.TL-MR150 v3.20< (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n
TP-Link Systems Inc.TL-MR100 v3.20< (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n; < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n,  Customized Software for South Korea KT; < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233908.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1233918.8Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1233948.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1233955.9Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information loCVE-2026-123407.5Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the SubjectCVE-2026-123419.8This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data CVE-2026-1234187.2The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and includCVE-2026-123429.6This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due CVE-2026-123436.5IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queuedCVE-2026-123455.9The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replaceCVE-2026-1234607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-fileCVE-2026-1234615.3Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Contro