CVE-2026-34027: Wertheim SafeController Path Traversal

CVE-2026-34027 Overview

CVE-2026-34027 affects Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The /safe/contract/uploadcustomdocuments endpoint performs insufficient server-side file type validation. The application trusts the client-supplied HTTP Content-Type header and accepts uploads if this value contains an allowed substring such as pdf, jpeg, tiff, or png. An authenticated attacker with any role can spoof the Content-Type value and upload arbitrary file content. The flaw is categorized as Unrestricted Upload of File with Dangerous Type [CWE-434].

Critical Impact
Any authenticated user, regardless of permission level, can upload arbitrary file content by manipulating the HTTP Content-Type header, undermining document integrity controls on the SafeController platform.

Affected Products

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
Wertheim Safe Deposit Box Management deployments using the affected SafeController build
Web applications exposing the /safe/contract/uploadcustomdocuments endpoint

Discovery Timeline

2026-06-15 - CVE-2026-34027 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34027

Vulnerability Analysis

The vulnerability resides in the file upload handler exposed at /safe/contract/uploadcustomdocuments. The server determines whether a submitted file is acceptable by inspecting the HTTP Content-Type request header. Validation succeeds whenever this header contains an approved substring such as pdf, jpeg, tiff, or png. Because the Content-Type value originates from the client, it can be set to any string the attacker chooses.

The handler does not perform magic byte inspection, file extension validation, or content sniffing on the uploaded payload. As a result, an attacker can submit binary or script content of any type while presenting a Content-Type header such as application/pdf. The server stores the attacker-supplied bytes despite the mismatch between the declared type and the actual payload.

Exploitation requires authentication, but the advisory states that any role or permission level is sufficient. This lowers the attack barrier in environments where low-privilege accounts are widely provisioned. According to the SEC Consult advisory, the issue corresponds to CWE-434: Unrestricted Upload of File with Dangerous Type.

Root Cause

The root cause is reliance on a user-controlled HTTP header for security-critical validation. Server-side controls perform a substring match against the Content-Type field instead of inspecting the file contents or restricting allowed extensions on disk.

Attack Vector

The attack vector is network-based against the web application. An authenticated attacker issues a multipart upload request to /safe/contract/uploadcustomdocuments with a forged Content-Type value containing one of the allowed substrings and arbitrary file bytes in the body. No user interaction is required.

For technical details, refer to the SEC Consult Security Analysis.

Detection Methods for CVE-2026-34027

Indicators of Compromise

Upload requests to /safe/contract/uploadcustomdocuments where the stored file's magic bytes do not match the declared Content-Type header.
Files in SafeController document storage with extensions or contents inconsistent with permitted document types (pdf, jpeg, tiff, png).
HTTP requests from low-privilege accounts containing crafted Content-Type values such as application/pdf; x=<binary>.

Detection Strategies

Inspect web server and application logs for POST requests to the uploadcustomdocuments endpoint and correlate declared content types with stored file signatures.
Run periodic file integrity scans against the SafeController document directory to identify files whose contents do not match their extension.
Deploy a web application firewall rule that validates uploaded file magic bytes server-side independent of the Content-Type header.

Monitoring Recommendations

Forward web application logs to a centralized SIEM and alert on unusual upload activity from non-administrative accounts.
Track upload volume and file types per user account to detect anomalous behavior.
Monitor the document storage path for the creation of executable, script, or archive files.

How to Mitigate CVE-2026-34027

Immediate Actions Required

Restrict access to the /safe/contract/uploadcustomdocuments endpoint to trusted networks or VPN users until a patched build is available.
Audit existing SafeController user accounts and remove unused or low-trust accounts that retain upload permissions.
Review stored documents for files whose contents do not match their declared type and quarantine suspicious uploads.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Contact Wertheim directly and consult the SEC Consult advisory for vendor remediation status. Apply any vendor-supplied update for SafeController versions later than AssemblyVersion 6.15.8328.28014 once released.

Workarounds

Place the SafeController web interface behind a reverse proxy that enforces server-side magic byte validation on multipart uploads.
Configure the upload directory with no execute permissions and serve files with a fixed Content-Disposition: attachment header to prevent inline rendering.
Apply least-privilege role assignments so only required staff retain document upload capability.

bash

# Example nginx reverse proxy hardening for the upload endpoint
location /safe/contract/uploadcustomdocuments {
    client_max_body_size 10m;
    limit_except POST { deny all; }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://safecontroller_backend;
}