CVE-2026-34030 Overview
CVE-2026-34030 is a path traversal vulnerability in Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The application does not sufficiently validate the branch code value supplied when creating a new branch. That branch code is subsequently incorporated into filesystem paths used for uploaded files, profile pictures, and settings. An authenticated user holding the settings_branches_manage privilege can embed path traversal sequences in the branch code and redirect file operations to unintended filesystem locations. The flaw is classified under CWE-73: External Control of File Name or Path.
Critical Impact
Authenticated attackers with branch management rights can write files outside intended directories, constrained by service-account permissions and branch code length.
Affected Products
- Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
Discovery Timeline
- 2026-06-15 - CVE-2026-34030 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-34030
Vulnerability Analysis
The Wertheim SafeController application uses the branch code field as a component of filesystem paths generated by several application functions. These functions include uploaded file storage, profile picture handling, and settings persistence. Because the branch code is not validated against directory traversal patterns at the point of branch creation, the unsafe value propagates into every downstream file operation that concatenates it into a path.
An attacker authenticated with the settings_branches_manage privilege can create a branch whose code contains sequences such as ..\ or ../. When the application later builds a path for a file write, the traversal sequence redirects the destination outside the intended branch directory. The result is arbitrary file placement within the writable scope of the service account running SafeController.
Root Cause
The root cause is missing input validation on the branch code field. The code is treated as a trusted identifier and inserted directly into path concatenation routines. No canonicalization or allowlist filtering is applied before the value reaches filesystem APIs.
Attack Vector
Exploitation requires network access to the SafeController web interface and an authenticated session holding the settings_branches_manage privilege. The attacker creates or modifies a branch with a crafted branch code containing traversal characters. Subsequent file upload, profile picture, or settings operations against that branch then write to attacker-influenced locations. Practical impact is bounded by branch code length limits and the write permissions assigned to the SafeController service account. Full technical details are available in the SEC Consult Report.
Detection Methods for CVE-2026-34030
Indicators of Compromise
- Branch records in the SafeController database whose branch_code field contains .., /, or \ characters.
- Files belonging to the SafeController service account appearing outside the configured upload, profile, or settings directories.
- Audit log entries showing branch creation or modification by accounts with settings_branches_manage immediately followed by file upload activity.
Detection Strategies
- Inspect HTTP request bodies sent to branch management endpoints for traversal sequences in the branch code parameter.
- Run periodic database queries against the branches table to flag any branch code containing path metacharacters.
- Correlate branch creation events with subsequent file write events at the operating system level to detect anomalous write paths.
Monitoring Recommendations
- Enable filesystem auditing on the SafeController installation directory and its parent paths to capture writes by the service account.
- Forward SafeController application logs and Windows Security event logs to a centralized SIEM for correlation.
- Alert on any new files created by the SafeController service account outside its designated data directories.
How to Mitigate CVE-2026-34030
Immediate Actions Required
- Audit all existing branch codes for traversal sequences or unexpected characters and remediate offending entries.
- Review accounts holding the settings_branches_manage privilege and revoke it from users who do not require branch administration.
- Restrict the SafeController service account to the minimum filesystem write permissions needed for normal operation.
Patch Information
No vendor patch information is referenced in the NVD entry. Administrators should contact Wertheim and consult the SEC Consult Report for vendor remediation status and any updated software releases addressing CVE-2026-34030.
Workarounds
- Limit settings_branches_manage privilege assignment to a small set of trusted administrators.
- Apply NTFS or filesystem access control lists that prevent the SafeController service account from writing outside designated data directories.
- Place the SafeController web interface behind a reverse proxy or web application firewall configured to reject requests containing .. or path separator characters in branch code parameters.
- Implement file integrity monitoring on directories adjacent to SafeController data folders to catch traversal-based writes early.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
