CVE-2026-5841

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Tenda	i3	1.0.0.6(2204)

References

https://github.com/MrXiaoFan/TendaVul/tree/main/tenda-i3-V1.0.0.6(2204)-R7WebsSecurityHandler-Authentication%20Bypass%20IssuesExploit, Third Party Advisory
https://vuldb.com/submit/789935Third Party Advisory, VDB Entry
https://vuldb.com/vuln/356297Third Party Advisory, VDB Entry
https://vuldb.com/vuln/356297/ctiPermissions Required, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-584107.1ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints CVE-2026-584117.0ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due CVE-2026-584128.2Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's f CVE-2026-584136.1Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes t CVE-2026-584145.5Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects fil CVE-2026-584155.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all plat CVE-2026-584167.1Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-584177.5REST API exposes organization membership of private organizations to public CVE-2026-584186.5SSRF via HTTP Redirect in Repository Migration CVE-2026-584197.5Notification API leaks private issue metadata after access revocation CVE-2026-58427.3A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of CVE-2026-584204.4Local File Inclusion via file:// URI in Migration Restore