EUVD-2026-41874
GHSA-xm42-w58j-mp94
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low privileges required per CVSS 4.0 source; read-only path traversal yields high confidentiality impact with no integrity, availability, or scope-change effect.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
A validation vulnerability has been identified in certain web features related to file management or upload in several products of the TAO 2.0 suite. This vulnerability could allow an attacker capable of interacting with the affected feature to attempt to access file system resources outside the scope intended by the application.
AnalysisAI
Path traversal in the T-Systems TAO 2.0 suite - spanning Archivo, MyTAO, Estima, and BuroWeb - allows an authenticated low-privileged attacker to escape the application's intended file scope via crafted paths submitted to web-based file management or upload features, yielding high confidentiality impact. The CVSS 4.0 vector confirms network accessibility with low privileges required and an additional attack prerequisite (AT:P), tempering the otherwise straightforward exploitation profile. A vendor patch is available per INCIBE advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) is the root cause: the application fails to canonicalize or sanitize user-supplied file path input in its web-facing file management and upload features, permitting directory traversal sequences to reference resources outside the intended document root. The affected software spans four products in the T-Systems TAO 2.0 suite: Archivo (cpe:2.3:a:t-systems:archivo), MyTAO (cpe:2.3:a:t-systems:mytao), Estima (cpe:2.3:a:t-systems:estima), and BuroWeb (cpe:2.3:a:t-systems:buroweb). All CPE entries carry full-version wildcards, indicating NVD has not published a bounded affected-version range - the entire installed base of each product must be treated as vulnerable until patched. The vulnerability class is well-understood and the exploit technique (e.g., '../'-chained path segments) is elementary.
RemediationAI
Apply the vendor-released patch referenced in the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/unauthorized-access-files-t-systems-products. No exact patched version number was derivable from the available data - consult T-Systems directly or the advisory to confirm the specific fixed release before deploying. As a compensating control while patching, restrict access to the file management and upload features to the minimum required user roles, eliminating low-privileged access to those endpoints where operationally feasible; this directly removes the PR:L attack surface. Additionally, deploy a web application firewall rule set to detect and block path traversal sequences (e.g., '../', '%2e%2e/', URL-encoded variants) on file-related endpoints - note that aggressive traversal rules can generate false positives on legitimate file operations and require tuning. Placing the applications behind an authenticated reverse proxy adds a defense-in-depth layer but does not remediate the underlying input validation defect.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today