CVE-2026-60114: Dan-in-ca SIP Path Traversal Vulnerability

CVE-2026-60114 Overview

CVE-2026-60114 is a path traversal vulnerability [CWE-22] in the Sustainable Irrigation Platform (SIP) through version 5.2.16. The flaw resides in the JSON backup restore functionality, which fails to validate keys used to construct file paths. Attackers with access to the restore endpoint can upload crafted JSON backup files to write arbitrary JSON files outside the intended data directory. The default configuration either requires no passphrase or uses the well-known default passphrase opendoor, allowing unauthenticated exploitation in many deployments. The vulnerability enables attackers to write files to arbitrary locations on the host filesystem over the network.

Critical Impact
Unauthenticated attackers can write arbitrary JSON files outside the intended data directory, potentially overwriting configuration files and compromising integrity of the SIP host.

Affected Products

Dan-in-ca Sustainable Irrigation Platform (SIP) through version 5.2.16
Deployments using the default (empty) restore passphrase configuration
Deployments using the default passphrase opendoor

Discovery Timeline

2026-07-14 - CVE-2026-60114 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-60114

Vulnerability Analysis

The Sustainable Irrigation Platform exposes a restore endpoint that ingests JSON backup archives. During restore, the application iterates over JSON keys and uses them directly as filename components when writing state files to disk. Because the keys are not sanitized against directory traversal sequences such as ../, an attacker can supply keys that resolve to paths outside the intended data directory.

The issue is compounded by weak access control on the restore function. In the default configuration, no passphrase is required, and installations that enable the passphrase check often retain the vendor default opendoor. This effectively removes the authentication barrier and allows remote, unauthenticated file writes.

Successful exploitation impacts integrity only. Attackers cannot execute arbitrary code directly through this primitive, but they can overwrite JSON configuration files consumed by the platform to alter its behavior.

Root Cause

The root cause is missing input validation on JSON object keys used in file path construction during the backup restore process. The application concatenates attacker-controlled key values with the base data directory without normalizing the resulting path or verifying containment. This is a classic path traversal weakness classified as [CWE-22].

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted JSON backup payload to the restore endpoint. Keys within the JSON contain traversal sequences that direct the writer to a location outside the data directory. If the target instance uses the default configuration or the opendoor passphrase, the write succeeds without further authentication.

The vulnerability manifests in the JSON restore handler where object keys are used unfiltered as path components. See the VulnCheck Security Advisory and Zero Science Advisory ZSL-2026-5996 for full technical details.

Detection Methods for CVE-2026-60114

Indicators of Compromise

Unexpected JSON files appearing outside the SIP data directory on the host filesystem
HTTP POST requests to the SIP restore endpoint containing JSON payloads with keys including ../ or absolute path sequences
Restore operations submitted with the default passphrase opendoor or with no passphrase from untrusted source addresses
Modification timestamps on SIP configuration files that do not correlate with legitimate administrative activity

Detection Strategies

Inspect HTTP request bodies to the SIP restore endpoint for JSON keys containing path traversal patterns such as .., ..\, or leading /
Monitor file creation events under directories that should never receive writes from the SIP service account
Correlate restore endpoint access with the source IP reputation and expected administrative user population

Monitoring Recommendations

Enable web server access logging for all requests to the restore endpoint and forward to a central log platform
Configure filesystem integrity monitoring on the SIP installation directory and any parent paths reachable via traversal
Alert on any restore attempt where the submitted passphrase equals the default value opendoor

How to Mitigate CVE-2026-60114

Immediate Actions Required

Restrict network access to the SIP web interface to trusted management hosts using firewall rules or a reverse proxy access control list
Change the restore passphrase to a strong, unique value and ensure the default opendoor value is not in use
Audit the SIP data directory and parent paths for unexpected JSON files that may indicate prior exploitation
Disable the restore functionality entirely if it is not required for operations

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-60114. Consult the VulnCheck Security Advisory and the Zero Science Advisory ZSL-2026-5996 for the latest remediation status. Users should upgrade to any release later than 5.2.16 once available from the maintainer.

Workarounds

Place the SIP interface behind an authenticated reverse proxy that terminates untrusted traffic before it reaches the restore endpoint
Run the SIP process under a low-privilege account that lacks write permissions to sensitive directories outside its data path
Configure a non-default passphrase and validate that restore requests without the correct passphrase are rejected
Apply filesystem-level access controls to prevent the SIP service account from writing outside its intended data directory

bash

# Configuration example: restrict SIP restore endpoint access via nginx
location /restore {
    allow 10.0.0.0/24;   # trusted management subnet
    deny all;
    proxy_pass http://127.0.0.1:8080;
}