Is there a public PoC exploit available for EUVD-2026-31825?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31825. Prioritise patching immediately. EPSS: 0.1%.

Acrel EEMS Platform EUVD-2026-31825

Q: What is the CVSS score of EUVD-2026-31825?

EUVD-2026-31825 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-9550 MEDIUM

Path Traversal (CWE-22)

2026-05-26 VulDB

GHSA-fvqp-9h26-84g3

Path Traversal Eems Enterprise Power Operation And Maintenance Cloud Platform

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:20 vuln.today

Severity Changed

May 26, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 15:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. Affected by this issue is some unknown functionality of the file /SubstationWEBV2/app/..;/main/upfile. Executing a manipulation of the argument path can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unauthenticated path traversal in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 exposes arbitrary file system access through the /SubstationWEBV2/app/..;/main/upfile endpoint by manipulating the path argument. The vulnerability is remotely exploitable with no authentication or user interaction required (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), and a publicly available proof-of-concept exists. Although EPSS sits at 0.09% (25th percentile), SSVC classifies this as automatable, and the vendor has not responded to disclosure, leaving no official patch available.

Technical ContextAI

The affected endpoint /SubstationWEBV2/app/..;/main/upfile exploits a well-known path traversal bypass technique specific to Java servlet containers such as Apache Tomcat, where the sequence ..; is interpreted as a directory traversal component by the underlying HTTP server while bypassing application-level access controls that only check normalized paths. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause class - the application fails to canonicalize or sanitize the path parameter before using it in file system operations. The affected product, identified via CPE cpe:2.3:a:acrel_electrical:eems_enterprise_power_operation_and_maintenance_cloud_platform:*:*:*:*:*:*:*:*, is an industrial energy management and power operations cloud platform typically deployed in electrical substation and enterprise power infrastructure environments, making unauthorized file access particularly sensitive given the operational technology (OT) context.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure and no advisory URL is available from the vendor. As a primary compensating control, restrict network access to the EEMS web interface at the firewall or reverse proxy layer, limiting access to trusted internal IP ranges only; this directly mitigates the AV:N (network) attack vector and is the highest-priority action. If the /SubstationWEBV2/app/..;/main/upfile endpoint is not required for operations, block or disable it at the web server or application layer - note this may disrupt file upload functionality if actively used. Deploy a web application firewall (WAF) rule to detect and block path traversal patterns including ..;, ../, and URL-encoded variants (%2e%2e, %2f) in the path parameter; be aware WAF rules may produce false positives on legitimate path arguments. Monitor web server logs for requests containing traversal sequences to the affected endpoint. Organizations should track vendor communications and apply an official patch as soon as one is released. VulDB reporting is available at https://vuldb.com/vuln/365609.