CVE-2026-29522: ZwickRoell Path Traversal Vulnerability

CVE-2026-29522 Overview

ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to information disclosure of sensitive system files.

Critical Impact

This vulnerability allows unauthenticated remote attackers to read arbitrary files from the server through path traversal, potentially exposing sensitive configuration files, credentials, and system data.

Affected Products

• ZwickRoell Test Data Management versions prior to 3.0.8

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-29522 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-29522

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in the Node.js-based upgrade service endpoint /server/node_upgrade_srv.js, which fails to properly sanitize user-supplied input in the firmware parameter.

When an attacker provides specially crafted directory traversal sequences (such as ../) within the firmware parameter, the application processes these without proper validation, allowing the attacker to escape the intended directory and access files anywhere on the filesystem that the application has read permissions for.

The vulnerability is particularly severe because it requires no authentication, meaning any network-accessible attacker can exploit it. The attack can be executed remotely over the network with low complexity, requiring no user interaction.

Root Cause

The root cause of this vulnerability is insufficient input validation in the /server/node_upgrade_srv.js endpoint. The application fails to:

1. Sanitize or reject directory traversal sequences (../, ..\\) in the firmware parameter
2. Validate that the requested file path remains within the intended directory boundary
3. Implement proper canonicalization of file paths before accessing the filesystem

This allows attackers to navigate outside the application's intended file access scope and read sensitive files such as /etc/passwd, application configuration files, or any other files readable by the web server process.

Attack Vector

The attack vector is network-based, targeting the vulnerable /server/node_upgrade_srv.js endpoint. An attacker crafts an HTTP request containing directory traversal sequences in the firmware parameter to escape the web root and access arbitrary files.

For example, an attacker might attempt to access system files by traversing up multiple directory levels and then specifying the target file path. Common targets include system password files, application configuration files containing database credentials, private keys, and other sensitive data.

The attack requires only network access to the vulnerable endpoint and can be performed by an unauthenticated user, making it easily exploitable in environments where the Test Data Management application is exposed to untrusted networks.

Detection Methods for CVE-2026-29522

Indicators of Compromise

• Web server access logs showing requests to /server/node_upgrade_srv.js containing ../ or encoded variants (%2e%2e%2f, %2e%2e/, ..%2f)
• Unusual file access patterns in application logs, particularly attempts to access files outside the normal application directories
• HTTP requests with abnormally long firmware parameter values containing repetitive traversal sequences

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing directory traversal patterns in URL parameters
• Configure intrusion detection systems (IDS) to alert on HTTP traffic containing path traversal sequences targeting Node.js endpoints
• Enable detailed access logging on web servers and monitor for requests to /server/node_upgrade_srv.js with suspicious parameter values
• Deploy file integrity monitoring on sensitive system files to detect unauthorized access attempts

Monitoring Recommendations

• Monitor web server logs for requests containing encoded or plain-text directory traversal sequences
• Set up alerting for any access to the vulnerable endpoint from external IP addresses
• Review application error logs for file access failures that may indicate exploitation attempts
• Implement network traffic analysis to identify reconnaissance activities targeting the ZwickRoell Test Data Management application

How to Mitigate CVE-2026-29522

Immediate Actions Required

• Upgrade ZwickRoell Test Data Management to version 3.0.8 or later immediately
• Restrict network access to the Test Data Management application to trusted networks only using firewall rules
• Implement web application firewall (WAF) rules to block requests containing directory traversal patterns
• Review access logs for evidence of prior exploitation attempts

Patch Information

ZwickRoell has addressed this vulnerability in Test Data Management version 3.0.8. Organizations should upgrade to this version or later to remediate the vulnerability. For additional information, refer to the VulnCheck Advisory and the ZwickRoell Test Data Management product page.

Workarounds

• If immediate patching is not possible, restrict network access to the /server/node_upgrade_srv.js endpoint using web server configuration or firewall rules
• Deploy a reverse proxy or WAF in front of the application configured to reject requests containing path traversal sequences
• Temporarily disable the firmware upgrade functionality if it is not operationally required
• Implement IP allowlisting to limit access to the application to known trusted sources only

# Example: Block access to vulnerable endpoint via nginx
location /server/node_upgrade_srv.js {
    deny all;
    return 403;
}

# Example: Restrict access to trusted network only
location /server/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}