Improper branch-code validation in Wertheim SafeController Software allows file path manipulation
Summary
| CVE | CVE-2026-34030 |
|---|---|
| State | PUBLISHED |
| Assigner | SEC-VLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-15 12:16:25 UTC |
| Updated | 2026-06-15 21:05:18 UTC |
| Description | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile pictures, and settings. An authenticated attacker with the settings_branches_manage privilege can include path traversal sequences in the branch code and influence the final filesystem location used by affected file operations. This can allow files to be stored in unintended locations, subject to service-account write permissions and branch-code length restrictions. |
Risk And Classification
Primary CVSS: v4.0 6.9 MEDIUM from 551230f0-3615-47bd-b7cc-93e92e730bbf
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003270000 probability, percentile 0.242140000 (date 2026-06-22)
Problem Types: CWE-73 | CWE-73 CWE-73 External control of file name or path
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 551230f0-3615-47bd-b7cc-93e92e730bbf | Secondary | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Wertheim GmbH | Wertheim SafeController Software For VAULT ROOMS Safe Deposit Locker System | affected Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| wertheim-safes.com/safe-deposit-box-management | 551230f0-3615-47bd-b7cc-93e92e730bbf | wertheim-safes.com | |
| r.sec-consult.com/wertheim | 551230f0-3615-47bd-b7cc-93e92e730bbf | r.sec-consult.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Christian Hager, SEC Consult Vulnerability Lab (en)
CNA: Gorazd Jank, SEC Consult Vulnerability Lab (en)
CNA: Philipp Espernberger, SEC Consult Vulnerability Lab (en)
Additional Advisory Data
Solutions
CNA: The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update.
Workarounds
CNA: Restrict branch-management privileges to trusted administrative users only. Validate branch codes on the server side using a strict allowlist of safe characters and reject path separators, traversal sequences, control characters, and other special characters. Ensure that filesystem paths are canonicalized and checked against an expected base directory before file operations are performed. Review service-account filesystem permissions so that the application can only write to required storage locations. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed.