CVE-2026-76652

MediumCVSS 4.8/10Last modified Sep 11, 2026

Description

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory.

Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.

Metrics

CVSS 4.0 4.8/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	TL-MR6400 v8	< 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
TP-Link Systems Inc.	Archer MR600	>= v3, < MR600(EU)_V3_1.4.0 Build 260827; >= v5, < MR600(EU)_V5_1.9.0 Build 260805; >= v2, < MR600(EU)_V2_1.12.0 Build 2600826

References

Timeline

Published: Sep 10, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-766535.3A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v CVE-2026-766545.8An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that poin CVE-2026-766557.5A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution CVE-2026-766565.3A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when tracero CVE-2026-7665710.0Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote att CVE-2026-7665810.0A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker CVE-2026-766597.5A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of ser CVE-2026-76663.1An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to p CVE-2026-766608.7A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766617.6A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766625.9A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.CVE-2026-766637.5A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.