CVE-2026-46747: SINEC INS Path Traversal Vulnerability

CVE-2026-46747 Overview

CVE-2026-46747 is a path traversal vulnerability in Siemens SINEC INS affecting all versions prior to V1.0 SP2 Update 6. The flaw resides in the GET /api/sftp/uploadFiles endpoint, which fails to properly sanitize path input used for directory listing. Authenticated attackers can supply crafted input containing traversal sequences to access file system locations outside the intended directory. The weakness is classified under [CWE-26] (Path Traversal: /dir/../filename).

Critical Impact
Authenticated network attackers can enumerate arbitrary file system paths on the SINEC INS host, exposing sensitive configuration and operational data.

Affected Products

Siemens SINEC INS — all versions prior to V1.0 SP2 Update 6
GET /api/sftp/uploadFiles directory listing endpoint
Industrial network management deployments relying on SINEC INS

Discovery Timeline

2026-06-09 - CVE-2026-46747 published to NVD
2026-06-09 - Last updated in NVD database
2026-06-09 - Siemens publishes Security Advisory SSA-860189

Technical Details for CVE-2026-46747

Vulnerability Analysis

The vulnerability stems from missing path sanitization in the SINEC INS SFTP file listing API. The GET /api/sftp/uploadFiles endpoint accepts a path parameter intended to scope directory enumeration to an upload directory. The application concatenates user-supplied input into a file system path without normalizing or rejecting parent-directory references such as ../.

An authenticated user with low privileges can submit traversal sequences in the request. The application then resolves the path outside the intended directory boundary and returns the listing of the targeted location. This exposes file and directory names across the host, supporting reconnaissance of configuration files, credentials material, and operational data.

The attack vector is network-based and requires only low privileges, with no user interaction. Confidentiality is impacted because file system structure outside the SFTP upload root becomes enumerable. Integrity and availability are not directly impacted by the listing operation itself.

Root Cause

The root cause is insufficient input validation on path components handled by the directory listing routine. The endpoint does not canonicalize the resolved path or verify that the result remains within the configured SFTP root before invoking the directory enumeration function.

Attack Vector

An authenticated attacker issues an HTTP request to GET /api/sftp/uploadFiles containing a path parameter populated with traversal sequences. The crafted input drives the server to list directories outside the intended sandbox. See the Siemens Security Advisory SSA-860189 for technical details.

Detection Methods for CVE-2026-46747

Indicators of Compromise

HTTP requests to /api/sftp/uploadFiles containing ../, ..%2f, or encoded traversal sequences in query parameters
Repeated directory listing responses referencing paths outside the configured SFTP upload directory
Authentication events for low-privilege SINEC INS accounts followed by atypical API enumeration patterns

Detection Strategies

Inspect SINEC INS application logs and reverse proxy logs for path parameters containing traversal tokens or URL-encoded variants
Baseline normal /api/sftp/uploadFiles request patterns and alert on requests referencing paths outside the upload root
Correlate authenticated session activity with sudden bursts of directory listing API calls

Monitoring Recommendations

Forward SINEC INS web application logs to a centralized SIEM for retention and query
Deploy web application firewall rules that flag or block path traversal patterns on the /api/sftp/ endpoints
Monitor for outbound transfers following suspicious directory enumeration to detect downstream data exfiltration attempts

How to Mitigate CVE-2026-46747

Immediate Actions Required

Upgrade SINEC INS to V1.0 SP2 Update 6 or later as directed by Siemens advisory SSA-860189
Restrict network access to the SINEC INS management interface to trusted operator subnets only
Audit SINEC INS user accounts and remove unnecessary low-privilege accounts that could be abused for authenticated exploitation

Patch Information

Siemens has released V1.0 SP2 Update 6 to address CVE-2026-46747. Refer to Siemens Security Advisory SSA-860189 for the official fixed version and download instructions.

Workarounds

Place SINEC INS behind a reverse proxy or WAF that rejects requests containing path traversal sequences targeting /api/sftp/uploadFiles
Apply network segmentation aligned with Siemens operational guidelines to limit reachability of the management API
Rotate credentials and review file system access logs if exploitation is suspected prior to patching

bash

# Example WAF rule pattern to block traversal on the affected endpoint
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@beginsWith /api/sftp/uploadFiles" \
    "chain,deny,status:400,id:1046747,msg:'SINEC INS path traversal attempt (CVE-2026-46747)'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.%2[fF]|%2e%2e/)" "t:none,t:urlDecodeUni"