CVE-2026-5487: DriveLock Path Traversal Vulnerability

CVE-2026-5487 Overview

CVE-2026-5487 is a directory traversal information disclosure vulnerability affecting DriveLock. The flaw resides in the DriveLock web service that listens on TCP port 4568 by default. Remote, unauthenticated attackers can supply crafted path values to read files accessible to the service account. The Zero Day Initiative tracks this issue as ZDI-CAN-28746 and published advisory ZDI-26-284. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can traverse directories via the DriveLock web service on TCP 4568 and disclose sensitive files readable by the service account.

Affected Products

DriveLock (web service component listening on TCP port 4568)
Refer to the DriveLock Security Bulletin for specific affected versions
Refer to Zero Day Initiative Advisory ZDI-26-284 for additional product coverage details

Discovery Timeline

2026-07-29 - CVE-2026-5487 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-5487

Vulnerability Analysis

The vulnerability exists in the DriveLock web service reachable over the network on TCP port 4568. The service accepts a user-supplied path and uses it in subsequent file operations without adequate validation. An attacker submits path segments containing traversal sequences such as ..\ or ../ to escape the intended directory. The service then resolves the constructed path and returns file contents accessible to its own service account.

Authentication is not required. Any network-reachable client can issue a request to the exposed endpoint. The vulnerability affects confidentiality only; integrity and availability remain unaffected, as reflected by the CVSS impact metrics.

Root Cause

The root cause is missing canonicalization and validation of a user-supplied pathname before it is passed into file read operations [CWE-22]. The service does not restrict the resolved path to an allowed base directory, nor does it reject traversal sequences. As a result, the process reads any file that the service account has permission to open.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the DriveLock web service on TCP 4568. The request includes a path parameter containing directory traversal sequences pointing at a target file outside the intended directory. The service resolves and reads the file, returning its contents to the attacker. Depending on the privileges of the service account, disclosed material may include configuration data, credentials stored on disk, and other sensitive artifacts.

No verified public exploit code is currently available. Technical details are documented in the Zero Day Initiative Advisory ZDI-26-284 and the DriveLock Security Bulletin.

Detection Methods for CVE-2026-5487

Indicators of Compromise

HTTP requests to TCP port 4568 containing traversal sequences such as ..%2F, ..\, or ../ in URL paths or query parameters
Successful 2xx responses from the DriveLock web service returning content larger than expected for standard API endpoints
Access log entries from unfamiliar external IP addresses targeting DriveLock service endpoints
Unexpected reads of sensitive files by the DriveLock service account outside its normal working directory

Detection Strategies

Deploy web application firewall or IDS rules that flag directory traversal patterns in requests directed at port 4568
Correlate DriveLock service process file-read telemetry against a baseline of expected file paths
Alert on any request to the DriveLock web service originating from outside management network segments

Monitoring Recommendations

Enable verbose logging on the DriveLock web service and forward logs to a centralized SIEM for retention and search
Monitor egress from DriveLock hosts for anomalous outbound transfers that could indicate exfiltration of harvested files
Track authentication and file-access events tied to the DriveLock service account for deviations from baseline

How to Mitigate CVE-2026-5487

Immediate Actions Required

Apply the patch documented in the DriveLock Security Bulletin 26-003 as soon as it is available in your maintenance window
Restrict network access to TCP port 4568 to trusted management subnets using host and network firewalls
Audit the DriveLock service account permissions and remove access to files outside required directories
Review web service and access logs for prior exploitation attempts against port 4568

Patch Information

DriveLock has published guidance in Security Bulletin 26-003 (Path Validation). Administrators should consult the official bulletin for fixed version numbers and upgrade instructions. Zero Day Initiative coordination is documented in ZDI-26-284.

Workarounds

Block inbound access to TCP port 4568 from untrusted networks until the patch is applied
Place the DriveLock web service behind a reverse proxy that rejects requests containing directory traversal sequences
Reduce the file system scope reachable by the DriveLock service account to the minimum required for operation

bash

# Example: restrict inbound access to TCP 4568 to a management subnet (Windows Advanced Firewall)
New-NetFirewallRule -DisplayName "DriveLock WebSvc - Restrict 4568" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 4568 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "DriveLock WebSvc - Block 4568 Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 4568 `
  -Action Block