Which versions of Thingsgateway are affected by EUVD-2026-12399?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4233, a path traversal vulnerability rated CVSS 4.3. This could allow unauthorized file access.

Is there a public PoC exploit available for EUVD-2026-12399?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12399. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12399?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Thingsgateway EUVD-2026-12399

Q: What is the CVSS score of EUVD-2026-12399?

EUVD-2026-12399 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4233 LOW

Path Traversal (CWE-22)

2026-03-16 VulDB

Path Traversal Thingsgateway N A

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 11:00 euvd

EUVD-2026-12399

Analysis Generated

Mar 16, 2026 - 11:00 vuln.today

CVE Published

Mar 16, 2026 - 10:02 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was identified in ThingsGateway 12. This affects an unknown part of the file /api/file/download. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in ThingsGateway 12's /api/file/download endpoint allows authenticated users to read arbitrary files through manipulation of the fileName parameter. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.

Technical ContextAI

This vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw where user-supplied input to the fileName parameter in the /api/file/download endpoint fails to sanitize directory traversal sequences such as '../' or absolute paths. ThingsGateway 12 (identified via CPE cpe:2.3:a:thingsgateway:thingsgateway:12) processes this unsanitized input when constructing file system paths, allowing an attacker to navigate outside the intended document root. The API endpoint lacks input validation, canonicalization, or whitelist-based filename restrictions that would prevent traversal attacks. This is a server-side vulnerability affecting the file download mechanism, a common architectural weakness in IoT gateway and industrial control systems.

RemediationAI

Upgrade ThingsGateway to a patched version if available from the upstream project; check the official ThingsGateway repository (typically on GitHub) for security releases addressing CVE-2026-4233. If no patch is immediately available, implement network-level mitigations including restricting API access to the /api/file/download endpoint via a Web Application Firewall (WAF) with rules blocking path traversal sequences (../, ..\, %2e%2e, etc.), enforcing authentication via OAuth or mutual TLS, and limiting file download requests to authenticated users from trusted IP ranges. Additionally, apply input validation on the server side by implementing a strict whitelist of allowed filenames and storing downloadable files in a separate, read-only directory outside the application root. Monitor access logs for suspicious fileName parameter patterns indicating exploitation attempts.