CVE-2026-9550: Acrel EEMS Path Traversal Vulnerability

CVE-2026-9550 Overview

CVE-2026-9550 is a path traversal vulnerability [CWE-22] in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. The flaw resides in the /SubstationWEBV2/app/..;/main/upfile endpoint, where manipulation of the path argument enables directory traversal. Remote attackers can exploit the issue without authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against exposed deployments. According to the disclosure record, the vendor was contacted prior to publication but did not respond.

Critical Impact
Unauthenticated remote attackers can traverse directories via the upfile endpoint to access files outside the intended scope, exposing sensitive operational data in power management deployments.

Affected Products

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0
Deployments exposing /SubstationWEBV2/app/..;/main/upfile
Substation web management interfaces shipped with the platform

Discovery Timeline

2026-05-26 - CVE-2026-9550 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9550

Vulnerability Analysis

The vulnerability affects the file upload handler reachable via /SubstationWEBV2/app/..;/main/upfile. The URL pattern uses ..; — a semicolon path parameter trick that some servlet containers and reverse proxies treat as part of the path segment rather than a traversal sequence. This allows the request to bypass mapping or filtering applied to the /app/ prefix and reach the upfile handler in the /main/ context.

Once the request reaches upfile, the handler consumes a user-controlled path argument without sufficient canonicalization. Attackers supply traversal sequences in path to write or read files outside the intended upload directory. The CWE-22 classification matches this pattern of improper limitation of a pathname to a restricted directory.

Exploitation requires only network reachability to the platform. No credentials are needed, and the attack does not depend on user interaction. The platform manages substation and power operation data, so traversal access can expose configuration files, logs, and operational records.

Root Cause

The root cause is a combination of two issues. First, the routing layer fails to normalize ..; sequences before applying access controls, enabling the attacker to reach an endpoint that should be protected. Second, the upfile handler trusts the path parameter without enforcing canonical paths or restricting writes to a fixed directory.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /SubstationWEBV2/app/..;/main/upfile with a path parameter containing traversal sequences such as ../. The server resolves the manipulated path and operates on a file outside the intended directory.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is available in this dataset. Technical details are tracked in the VulDB Vulnerability #365609 entry and the Feishu Wiki Document referenced by the disclosure.

Detection Methods for CVE-2026-9550

Indicators of Compromise

HTTP requests to /SubstationWEBV2/app/..;/main/upfile from external sources
Requests containing ..;, ..%2f, or encoded traversal sequences in the URL path
path parameter values containing ../, ..\\, or absolute file paths in upfile requests
Unexpected file reads or writes outside the configured upload directory on the application server

Detection Strategies

Inspect web server and reverse proxy access logs for the literal string ..; in request paths targeting the SubstationWEBV2 application
Alert on any upfile request where the path argument resolves outside the application's upload root
Correlate inbound HTTP requests with subsequent file system activity on the application server using EDR telemetry

Monitoring Recommendations

Enable verbose access logging on the SubstationWEBV2 endpoint and forward logs to a centralized SIEM or data lake
Monitor for high-volume scanning patterns hitting the /SubstationWEBV2/app/ path from a single source
Track outbound transfers of configuration or backup files from the application host

How to Mitigate CVE-2026-9550

Immediate Actions Required

Restrict network access to the EEMS platform management interface using firewall rules or a VPN gateway
Place a web application firewall in front of the platform with rules that block ..; and encoded traversal sequences
Audit recent access logs for requests matching the vulnerable URL pattern and investigate any matches
Rotate credentials and secrets stored in files reachable from the application directory

Patch Information

No vendor patch has been published at the time of disclosure. According to the VulDB record, the vendor was contacted early about this disclosure but did not respond. Track the VulDB Vulnerability #365609 entry for updates and verify any future advisories directly with Acrel before deployment.

Workarounds

Block requests containing ..; path segments at the reverse proxy or WAF layer
Disable or remove the /SubstationWEBV2/app/..;/main/upfile endpoint if it is not required for operations
Apply strict input validation on any reverse proxy that fronts the application, rejecting path parameters with traversal characters
Isolate the application server from sensitive file shares until a vendor fix is available

bash

# Example nginx rule to block ..; traversal patterns
location /SubstationWEBV2/ {
    if ($request_uri ~* "\.\.;") {
        return 403;
    }
    if ($arg_path ~* "(\.\./|\.\.\\)") {
        return 403;
    }
    proxy_pass http://eems_backend;
}