CVE-2026-5492: DriveLock Path Traversal Vulnerability

CVE-2026-5492 Overview

CVE-2026-5492 is a directory traversal vulnerability in DriveLock that allows authenticated remote attackers to disclose sensitive information from affected installations. The flaw exists in the DriveLock web service that listens on TCP port 4568 by default. The service fails to properly validate user-supplied paths before using them in file operations, enabling attackers to read files outside the intended directory. Successful exploitation returns file contents in the context of the DriveLock service account. This issue was originally tracked by the Zero Day Initiative as ZDI-CAN-28713 and classified under [CWE-22].

Critical Impact
Authenticated attackers can read arbitrary files accessible to the DriveLock service account by supplying crafted paths to the web service on TCP port 4568.

Affected Products

DriveLock (web service component listening on TCP port 4568)
Refer to the DriveLock Security Bulletin for exact affected versions
Refer to the Zero Day Initiative Advisory ZDI-26-288 for advisory details

Discovery Timeline

2026-07-29 - CVE-2026-5492 published to the National Vulnerability Database (NVD)
2026-07-30 - CVE-2026-5492 record last modified in the NVD

Technical Details for CVE-2026-5492

Vulnerability Analysis

The vulnerability resides in the DriveLock web service, which exposes an HTTP interface on TCP port 4568. The service accepts user-supplied path parameters and uses them directly in file operations without normalizing or validating the resolved path. An authenticated attacker can submit path components such as ../ sequences to escape the intended directory and reference files elsewhere on the file system.

Because file operations execute under the DriveLock service account, the disclosed content is limited to files that account can read. On typical Windows deployments, this account often holds elevated privileges to support endpoint security enforcement, expanding the set of readable files. The vulnerability affects confidentiality only; integrity and availability are not directly impacted.

Root Cause

The root cause is missing canonicalization and validation of the user-supplied path prior to file access, a classic path traversal weakness tracked under [CWE-22]. The web service trusts input strings and passes them into file I/O routines without checking whether the resolved path remains within an allowed base directory.

Attack Vector

Exploitation requires network access to the DriveLock web service on TCP port 4568 and valid credentials to authenticate to that service. Once authenticated, the attacker issues a request containing a crafted path referencing a file outside the intended directory. The service resolves the path, opens the target file, and returns its contents to the attacker. No user interaction beyond the attacker's own request is required.

// No verified proof-of-concept code is publicly available.
// Refer to ZDI-26-288 and the DriveLock Security Bulletin
// for authoritative technical detail.

Detection Methods for CVE-2026-5492

Indicators of Compromise

HTTP requests to TCP port 4568 containing path traversal sequences such as ../, ..\, %2e%2e%2f, or %2e%2e%5c in query strings or request bodies.
Authenticated DriveLock web service requests referencing file paths outside the product's installation directory.
DriveLock service account file read events targeting sensitive locations such as C:\Windows\, user profiles, or configuration stores.

Detection Strategies

Inspect DriveLock web service logs for requests containing encoded or literal directory traversal patterns targeting port 4568.
Correlate authentication events against the DriveLock web service with subsequent anomalous file access performed by the service account.
Deploy web application firewall or reverse proxy rules that flag path traversal patterns in requests destined for the DriveLock endpoint.

Monitoring Recommendations

Enable and centralize DriveLock web service access logs, including the full request URI and authenticated principal.
Monitor file system audit events for reads by the DriveLock service account outside its expected working directories.
Alert on outbound data volumes from the DriveLock host that deviate from established baselines, which may indicate bulk file disclosure.

How to Mitigate CVE-2026-5492

Immediate Actions Required

Apply the fix documented in the DriveLock Security Bulletin 26-003 as soon as it is available for your deployment.
Restrict network reachability of TCP port 4568 to management workstations and administrative subnets only.
Rotate credentials used to authenticate to the DriveLock web service and enforce least privilege for those accounts.
Review the DriveLock service account permissions and remove any file system access not required for normal operation.

Patch Information

DriveLock has published guidance under Security Bulletin 26-003 titled "Path Validation." Consult the vendor bulletin and the Zero Day Initiative Advisory ZDI-26-288 for fixed version numbers and update instructions. Test the update in a staging environment before broad rollout.

Workarounds

Block or firewall inbound access to TCP port 4568 from untrusted networks until the patch is deployed.
Limit web service authentication to a small set of administrative accounts and monitor their activity closely.
Place the DriveLock management endpoint behind a reverse proxy that rejects requests containing path traversal sequences.

bash

# Example: restrict TCP port 4568 to a management subnet on Windows
netsh advfirewall firewall add rule ^
  name="DriveLock-4568-Restrict" ^
  dir=in protocol=TCP localport=4568 ^
  remoteip=10.10.20.0/24 action=allow

netsh advfirewall firewall add rule ^
  name="DriveLock-4568-BlockOther" ^
  dir=in protocol=TCP localport=4568 ^
  action=block