Which versions of Sustainable Irrigation Platform are affected by CVE-2026-60114?

The Sustainable Irrigation Platform (SIP) versions through 5.2.16 contain a critical arbitrary file-write vulnerability that enables unauthenticated remote attackers to plant malicious JSON files on…

Is there a public PoC exploit available for CVE-2026-60114?

Yes, a public proof-of-concept exploit is available for CVE-2026-60114. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-60114?

Within 24 hours: inventory all systems running SIP through 5.2.16 and immediately block external access to the JSON restore endpoint at the perimeter firewall or load-balancer-this eliminates attack surface without system downtime. Within 7 days: enforce strong authentication on the restore endpoint by replacing any hardcoded 'opendoor' credential with a 20+ character unique passphrase; deploy file-integrity monitoring configured to alert on any .json file creation outside the designated /data backup directory, with automated notifications to security operations. Within 30 days: continuously check VulnCheck and SIP vendor security advisories for patch availability; conduct forensic analysis of endpoint access logs and file-write audit trails from the past 90 days to detect evidence of compromise; if no patch emerges within 30 days, formally evaluate alternative irrigation platform solutions with stronger default security posture.

Sustainable Irrigation Platform CVE-2026-60114

Q: What is the CVSS score of CVE-2026-60114?

CVE-2026-60114 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43687 HIGH

Path Traversal (CWE-22)

2026-07-14 VulnCheck

GHSA-9xpx-72mq-c8x9

Path Traversal Sip

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable restore feature exploitable at low complexity with no auth in default config (PR:N), yielding arbitrary file write (I:H) but no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:32 vuln.today

CVE Published

Jul 14, 2026 - 14:37 cve.org

HIGH 8.7

DescriptionCVE.org

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

AnalysisAI

Arbitrary file write in Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers plant JSON files outside the intended data directory by abusing the JSON backup-restore feature, which builds file paths from attacker-controlled keys without validation. Because the default deployment ships with no required passphrase (or the hardcoded default 'opendoor'), an attacker can reach the restore endpoint without legitimate credentials. Publicly available exploit code exists (VulnCheck / Zero Science advisory), and EPSS/KEV data were not provided, so exploitation appears proof-of-concept rather than confirmed in-the-wild.

Technical ContextAI

SIP is a web-based irrigation management application (CPE cpe:2.3:a:dan-in-ca:sip). The flaw is a classic CWE-22 path traversal (Improper Limitation of a Pathname to a Restricted Directory): the restore routine deserializes an uploaded JSON backup and uses the object's keys directly as filesystem path components. Because those keys are neither sanitized nor constrained to the data directory, traversal sequences (e.g. ../) let the write operation escape the intended folder. The weakness is compounded by an authentication design flaw - the backup/restore protection relies on a passphrase that is empty in the default configuration or set to the well-known default 'opendoor', so the security boundary that should gate the feature is effectively absent out of the box.

RemediationAI

No fixed version was included in the supplied data, so treat this as No vendor-released patch identified at time of analysis and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/sustainable-irrigation-platform-path-traversal-via-json-backup-restore) and Zero Science advisory (https://www.zeroscience.mk/#/advisories/ZSL-2026-5996) for an upgrade beyond 5.2.16. As immediate compensating controls, set a strong, non-default backup passphrase to replace the empty/'opendoor' default (this alone removes the unauthenticated path but does not fix the traversal for those who know the passphrase), restrict network access to the restore/backup endpoint via firewall rules or a reverse-proxy allowlist so only trusted administrative hosts can reach it, and place the application behind authentication and off the public internet. Where feasible, run the service under a low-privileged account with a read-only or tightly scoped filesystem so a successful traversal cannot overwrite sensitive files outside the data directory; the trade-off is that overly strict filesystem permissions may break legitimate backup restores and require testing.