CVE-2026-34026: Wertheim SafeController Path Traversal

CVE-2026-34026 Overview

CVE-2026-34026 is a path traversal vulnerability [CWE-23] in Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The flaw exists in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation. An authenticated attacker with any role can traverse outside the intended document directory and download arbitrary files accessible to the application process. Retrievable content includes application log files containing sensitive information and application binaries.

Critical Impact
Any authenticated user can read arbitrary files from the SafeController host, exposing logs, configuration data, and application binaries that may aid further attacks.

Affected Products

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
Self-service document endpoint /safe/selfservice/openselfservicedocument
Safe deposit box management deployments using the affected build

Discovery Timeline

2026-06-15 - CVE-2026-34026 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34026

Vulnerability Analysis

The vulnerability resides in the /safe/selfservice/openselfservicedocument endpoint of the SafeController web application. The endpoint accepts a documentName parameter that the application uses to build a file path before opening and returning the file contents. Because the application fails to validate or canonicalize the input, an attacker can supply directory traversal sequences such as ..\ or ../ to escape the designated document directory.

Any authenticated account, regardless of role or permission level, can invoke the endpoint. This lowers the barrier to exploitation significantly in environments where self-service users routinely receive credentials. Attackers can retrieve sensitive files within the file system scope of the application process, including log files, configuration material, and application binaries.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified under [CWE-23]. The application concatenates user-supplied input into a file path without enforcing a safe base directory, rejecting traversal sequences, or validating the resolved canonical path against an allow list. Authorization checks on the endpoint do not constrain which files the parameter can address.

Attack Vector

Exploitation requires network access to the SafeController web interface and valid credentials at any privilege level. The attacker issues a request to /safe/selfservice/openselfservicedocument with a documentName value containing relative path traversal sequences pointing at files outside the document directory. The server resolves the path and returns the file content in the response. No user interaction is required beyond the attacker's authenticated session.

For technical specifics, refer to the SEC Consult Security Advisory.

Detection Methods for CVE-2026-34026

Indicators of Compromise

HTTP requests to /safe/selfservice/openselfservicedocument containing ..\, ../, encoded variants such as %2e%2e%2f, or absolute paths in the documentName parameter.
Application log entries showing successful document retrieval for filenames outside the configured document directory.
Self-service user accounts accessing application log files, configuration files, or binaries via the endpoint.

Detection Strategies

Inspect web server and application logs for requests targeting openselfservicedocument with traversal patterns or unexpected file extensions (.log, .exe, .dll, .config).
Alert on responses from the endpoint that exceed typical document sizes or return non-document MIME types.
Correlate authentication events with document download activity to identify low-privilege users accessing administrative content.

Monitoring Recommendations

Enable verbose request logging on the SafeController web tier, capturing full query strings and request bodies for the affected endpoint.
Forward logs to a centralized analytics platform and build detections for path traversal signatures against the documentName parameter.
Review baseline behavior of self-service accounts and flag deviations such as repeated document retrievals or off-hours activity.

How to Mitigate CVE-2026-34026

Immediate Actions Required

Contact Wertheim to confirm patch availability for AssemblyVersion 6.15.8328.28014 and apply the fixed release once provided.
Restrict network access to the SafeController web interface so it is reachable only from trusted management networks.
Audit accounts with access to the self-service portal and disable inactive or unnecessary credentials.
Review application and access logs for prior exploitation attempts targeting /safe/selfservice/openselfservicedocument.

Patch Information

No vendor advisory URL is listed in the NVD entry at publication. Coordinate with Wertheim support for remediation guidance and consult the SEC Consult Security Advisory for disclosure details. Product context is available in the Wertheim Safe Deposit Management Guide.

Workarounds

Deploy a reverse proxy or web application firewall rule that blocks requests to /safe/selfservice/openselfservicedocument containing .., %2e%2e, backslashes, or absolute path indicators in documentName.
Run the SafeController application service under a least-privilege account whose file system access is limited to the required document directory.
Relocate or restrict permissions on application log files and binaries so the service account cannot read sensitive material outside the document store.
Where feasible, disable the self-service document endpoint until the vendor releases a fix.

bash

# Example WAF rule blocking traversal patterns on the affected endpoint
SecRule REQUEST_URI "@beginsWith /safe/selfservice/openselfservicedocument" \
  "chain,deny,status:403,id:1026034026,msg:'CVE-2026-34026 path traversal attempt'"
  SecRule ARGS:documentName "@rx (\.\./|\.\.\\|%2e%2e[/\\]|^[A-Za-z]:\\|^/)" "t:none,t:urlDecodeUni"