Powerchute Serial Shutdown CVE-2026-2399

The vulnerability is a classic CWE-22 path traversal flaw in a REST API endpoint that processes user-supplied file path parameters without proper validation or sanitization. PowerChute Serial Shutdown, a Schneider Electric UPS management application, fails to restrict directory access when parsing the POST /REST/upssleep request payload, allowing an authenticated administrator to traverse the filesystem using relative path sequences (such as '../') to write data outside intended directories. This flaw exists in the web administration interface and affects the application's ability to enforce pathname restrictions, a critical control in multi-user or high-security deployments where administrative credentials may be compromised or misused.