Logsign SIEM EUVD-2026-88291

Requires a valid low-privileged authenticated session on the Logsign SIEM web/API interface (PR:L), reachable over the network (AV:N), with no user interaction. Exploitation targets a path/filename parameter that fails to sanitize traversal sequences; based on the I:H/A:L impact this is an arbitrary file WRITE primitive rather than file read. Limiting factors: the attacker must already possess credentials to the appliance, and only deployments running versions 6.4.101 through 6.4.116 are affected (fixed in 6.4.117). No special non-default configuration is indicated by the advisory.

This is a genuine but qualified priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) describes a network-reachable, low-complexity path traversal requiring only low-level authentication and no user interaction. Notably the impact profile is C:N / I:H / A:L - no confidentiality impact but HIGH integrity impact, which strongly implies this is a file-WRITE traversal (arbitrary file creation/overwrite) rather than the more common read-based traversal that would show C:H. That makes the 'High Integrity' rating credible. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent widespread exploitation - the SSVC posture is best read as 'exploitation: none/POC-absent, automatable: likely (network + low complexity), technical impact: partial-to-total on integrity.' Net: a real, patch-worthy authenticated flaw in a security appliance, but currently a low-to-moderate real-world urgency because exploitation requires valid credentials and no exploitation signal exists. One caveat to verify with the vendor: the C:N alongside I:H/A:L is unusual for a path traversal - confirm whether it is a write-only primitive as inferred.

An attacker who already holds a low-privileged authenticated account on a Logsign SIEM instance (versions 6.4.101 up to before 6.4.117) sends a crafted request containing directory-traversal sequences in a file/path parameter, causing the application to write or overwrite files outside the intended directory. By dropping or corrupting configuration, log-integrity, or executable files, the attacker undermines the SIEM's integrity and potentially disrupts a service component. No public exploit code is identified at time of analysis.