Logsign SIEM CVE-2026-105947

Exploitation requires an authenticated session against Logsign SIEM (CVSS PR:L), reachable over the network (AV:N), with no user interaction (UI:N) and low complexity (AC:L); the attacker must reach the vulnerable endpoint and supply traversal sequences in a pathname parameter. The specific feature, endpoint, or parameter that is vulnerable is not described in the available sources. Limiting factors: only Logsign SIEM builds from 6.4.120 up to (but not including) 6.4.122 are affected, the prior authentication requirement bars fully anonymous attackers, and impact is confined to confidentiality (file disclosure) with no integrity or availability effect.

This is a moderate-severity, authenticated path traversal (CWE-22) in Logsign SIEM, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The signals are largely consistent and point to a real but non-emergency issue: the vector indicates a network-reachable attack of low complexity that requires some level of existing privilege (PR:L, i.e. an authenticated user) and yields high confidentiality impact only (C:H) with no integrity or availability impact. No EPSS score, CISA KEV listing, SSVC exploitation-status data, or PoC reference is present in the input, so there is no evidence of active exploitation or public exploit code - the sole reference is a USOM (Turkish national CSIRT) advisory, which is an authoritative report of the flaw rather than proof of exploitation. The vuln.today priority 'this_month' aligns with a vulnerability worth timely patching but not an immediate fire-drill. Net: this is a credible, patch-this-cycle issue, not a high-CVSS-but-low-real-risk artifact, though the confidentiality-only impact and the authentication requirement meaningfully limit its blast radius compared with an unauthenticated RCE.

An authenticated Logsign SIEM user (or an attacker who has obtained valid credentials) sends a crafted request containing directory-traversal sequences to an affected endpoint, causing the application to resolve a pathname outside its intended restricted directory and return the contents of sensitive files on the host. No public exploit code or PoC was identified in the available data, and the low attack complexity (AC:L) means that once the vulnerable endpoint and parameter are known, the request is straightforward to construct.