CVE-2026-76158: Datiphy Data Management Path Traversal

CVE-2026-76158 Overview

CVE-2026-76158 is a critical path traversal vulnerability in the upload API endpoint of Datiphy Data Management Center. The flaw affects versions v8.3.0 through v8.5.1 and stems from external control of file name or path [CWE-73]. Remote unauthenticated attackers can write files to arbitrary locations outside the intended upload directory by supplying relative or absolute path sequences. Successful exploitation compromises file integrity, application availability, and downstream system security. The vulnerability requires no privileges or user interaction, and network reachability to the upload endpoint is sufficient for exploitation.

Critical Impact
Unauthenticated remote attackers can write attacker-controlled files anywhere on the host, enabling code execution, configuration tampering, and full compromise of the Data Management Center.

Affected Products

Datiphy Data Management Center v8.3.0
Datiphy Data Management Center v8.4.x
Datiphy Data Management Center v8.5.0 through v8.5.1

Discovery Timeline

2026-08-21 - CVE-2026-76158 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76158

Vulnerability Analysis

The Datiphy Data Management Center exposes an upload API endpoint that accepts a client-supplied file name or path parameter. The endpoint fails to canonicalize the destination path or restrict writes to the intended upload directory. Attackers can supply relative traversal sequences such as ../ or absolute paths to redirect the write operation to arbitrary filesystem locations. Because the endpoint is reachable over the network without authentication, exploitation reduces to a single crafted HTTP request. The impact spans integrity and availability of the target host, plus cascading effects on subsystems that trust content in the affected directories.

Root Cause

The root cause is external control of file name or path [CWE-73]. The upload handler concatenates user-supplied path components with a base directory without normalization or allow-list validation. It does not verify that the resolved absolute path remains within the intended upload root. It also does not enforce authentication or authorization prior to performing the write.

Attack Vector

A remote attacker sends a crafted request to the upload API with a file name parameter containing traversal sequences or an absolute path. The server writes the request body to the attacker-controlled destination using the privileges of the Data Management Center service account. Attackers commonly abuse this pattern to drop web shells into web-accessible directories, overwrite service binaries or configuration files, replace scheduled task definitions, or write SSH authorized keys to gain persistent access. Refer to the Zuso AI Security Advisory for endpoint specifics.

Detection Methods for CVE-2026-76158

Indicators of Compromise

HTTP requests to the Datiphy upload API containing .., %2e%2e, backslash traversal, or absolute path prefixes such as /etc/, C:\, or /var/www/ in the file name parameter.
New or modified files outside the configured upload directory owned by the Datiphy service account.
Unexpected script files (.jsp, .php, .aspx, .sh) appearing under web-accessible paths served by the Data Management Center.
Outbound connections initiated by the Datiphy process to unfamiliar hosts following upload activity.

Detection Strategies

Inspect web server and application logs for upload requests whose file name parameter contains path separators or encoded traversal sequences.
Deploy web application firewall signatures that flag traversal patterns targeting the Datiphy upload endpoint.
Baseline the file system paths the Datiphy service writes to and alert on writes outside that allow list.
Correlate upload events with subsequent process creation or network activity from the Datiphy service account.

Monitoring Recommendations

Enable verbose access logging on the Data Management Center and forward logs to a centralized SIEM for retention and analysis.
Monitor file integrity for system directories, web roots, cron paths, and startup script locations on hosts running Datiphy.
Alert on child processes spawned by the Datiphy service that are not part of its known execution profile.

How to Mitigate CVE-2026-76158

Immediate Actions Required

Restrict network access to the Datiphy upload API to trusted management networks using firewall rules or a reverse proxy allow list.
Audit the Data Management Center host for unauthorized files written outside the intended upload directory since deployment of any affected version.
Rotate credentials, API keys, and certificates stored on or accessible from the affected host if compromise is suspected.
Run the Datiphy service under a least-privilege account with no write access to system or web directories.

Patch Information

Datiphy has not published a fixed version reference in the NVD record at the time of writing. Consult the Zuso AI Security Advisory and contact Datiphy support for the current patched release. Upgrade all instances running versions v8.3.0 through v8.5.1 once a fixed build is available.

Workarounds

Place the upload endpoint behind a web application firewall that blocks requests containing path traversal sequences or absolute path prefixes in file name parameters.
Apply mandatory access controls (SELinux, AppArmor) to confine the Datiphy service to its expected write paths.
Disable the upload API entirely if it is not required for operations until a patch is installed.

bash

# Example nginx reverse-proxy rule blocking traversal in the upload endpoint
location /api/upload {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e|/etc/|/var/|C:\\)") {
        return 403;
    }
    proxy_pass http://datiphy_backend;
}