CVE-2026-5491: DriveLock Path Traversal Vulnerability

CVE-2026-5491 Overview

CVE-2026-5491 is a directory traversal vulnerability in DriveLock that allows unauthenticated remote attackers to disclose sensitive files from affected installations. The flaw resides in the DriveLock web service, which listens on TCP port 6067 by default. The service fails to validate user-supplied paths before performing file operations, enabling attackers to traverse the file system and read arbitrary files accessible to the service account. The issue is tracked as ZDI-CAN-28722 and was disclosed through the Zero Day Initiative as ZDI-26-287. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can read sensitive files in the context of the DriveLock service account by sending crafted requests to the web service on TCP port 6067.

Affected Products

DriveLock endpoint protection suite exposing the web service on TCP port 6067
See the DriveLock Security Bulletin for the specific affected build range
Deployments where the DriveLock management interface is reachable from untrusted networks

Discovery Timeline

2026-07-29 - CVE-2026-5491 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-5491

Vulnerability Analysis

The vulnerability affects the DriveLock web service component listening on TCP port 6067. The service accepts HTTP requests containing a path parameter and passes that value into file operations without normalizing or restricting it to an intended base directory. An attacker can supply traversal sequences such as ../ to escape the intended directory and reference arbitrary paths on the underlying host.

Because the endpoint does not require authentication, exploitation only requires network reachability to port 6067. The service returns file contents to the caller, resulting in disclosure of any file readable by the DriveLock service account. On typical Windows deployments, that account runs with elevated privileges and can access configuration files, credential material, and endpoint policy data.

The CVSS vector indicates a confidentiality-only impact with no integrity or availability effect, consistent with an information disclosure primitive rather than code execution.

Root Cause

The root cause is missing canonicalization and allow-list validation of a user-supplied path before it is consumed by a file read operation. The web service concatenates attacker input into a filesystem path and opens the resulting file without verifying that the resolved path remains within an approved directory. This is a textbook [CWE-22] path traversal pattern.

Attack Vector

An attacker sends a crafted HTTP request to the DriveLock web service on TCP port 6067. The request includes a file or path parameter containing directory traversal sequences that resolve outside the intended content directory. The service opens the resolved path and returns the file contents in the HTTP response. No credentials, tokens, or user interaction are required.

Exploitation details are documented in the Zero Day Initiative advisory ZDI-26-287. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-5491

Indicators of Compromise

HTTP requests to TCP port 6067 on DriveLock hosts containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Access log entries showing requests for absolute paths or references to sensitive files such as web.config, drivelock.ini, or Windows credential stores
Outbound responses from the DriveLock web service that are unusually large relative to normal API traffic
Requests to the DriveLock web service originating from IP addresses outside the management network

Detection Strategies

Inspect DriveLock web service and reverse-proxy logs for path parameters containing traversal metacharacters or encoded variants
Deploy web application firewall or IDS signatures that flag directory traversal patterns targeting TCP port 6067
Correlate file read events on the DriveLock server against inbound HTTP requests to identify anomalous access initiated by the service account

Monitoring Recommendations

Alert on any inbound connections to TCP port 6067 from outside the designated administrative network
Baseline normal request patterns to the DriveLock web service and alert on deviations in path structure or response size
Forward DriveLock host telemetry, including process, file, and network events, to a centralized analytics platform for retrospective hunting

How to Mitigate CVE-2026-5491

Immediate Actions Required

Apply the fixed DriveLock version referenced in the DriveLock Security Bulletin 26-003
Restrict inbound access to TCP port 6067 to trusted management subnets using host and network firewalls
Review DriveLock service account permissions and reduce filesystem access to the minimum required set
Audit DriveLock web service logs for prior exploitation attempts using traversal patterns

Patch Information

DriveLock has published a security bulletin describing the path validation fix. Administrators should consult the DriveLock Security Bulletin 26-003 for the exact fixed build numbers and upgrade procedure, and cross-reference the ZDI-26-287 advisory for coordinated disclosure details.

Workarounds

Block external access to TCP port 6067 at the perimeter and permit only administrative hosts
Place the DriveLock web service behind a reverse proxy that normalizes URLs and rejects path traversal sequences
Isolate DriveLock management servers on a dedicated VLAN with strict egress and ingress controls until patching is complete

bash

# Example Windows Firewall rule limiting TCP 6067 to a management subnet
New-NetFirewallRule -DisplayName "DriveLock-6067-MgmtOnly" \
  -Direction Inbound -Protocol TCP -LocalPort 6067 \
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "DriveLock-6067-BlockAll" \
  -Direction Inbound -Protocol TCP -LocalPort 6067 \
  -Action Block