Datiphy Data Management Center CVE-2026-76158

Exploitation requires network reachability to the Datiphy Data Management Center upload API endpoint on a vulnerable instance (v8.3.0-v8.5.1); no authentication, credentials, or user interaction are needed per the CVSS 4.0 vector (PR:N/UI:N/AT:N). The concrete prerequisite is the ability to reach the upload endpoint and supply a file name or path containing relative ('../') or absolute path sequences. The main limiting factor is exposure: appliances confined to isolated management networks are far harder to reach, and the achievable impact depends on the write permissions of the service account and which sensitive paths are writable on the target host.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, low-complexity exploitation with no authentication and no user interaction, and the impact metrics (VI:H/VA:H plus subsequent SI:H/SA:H) reflect that arbitrary file write can cascade into full compromise of both the application and its host. No EPSS score, KEV listing, or POC is present in the provided data, so exploitation is not confirmed in the wild; however, arbitrary-write-to-RCE is a well-understood and highly automatable pattern, so the absence of a published exploit should not be read as low risk. The only meaningful uncertainty is confidentiality impact - the vendor vector sets VC:N/C:N, implying no direct data disclosure, which is plausible for a pure write primitive but worth verifying since arbitrary write frequently enables indirect disclosure. Given no auth barrier and a network vector, any operator exposing this appliance should treat it as urgent regardless of organization size.

An attacker with only network access to the appliance sends a crafted request to the upload API with a filename containing '../../' or an absolute path, causing the service to write attacker-controlled content into a sensitive location such as a web root, startup script, or configuration file. By overwriting an executable or scheduled/loaded file, the attacker escalates the write primitive to code execution on the host. No public exploit is identified yet, but the low complexity and lack of authentication make development trivial.