CVE-2026-4542 Details

A path traversal vulnerability has been identified in SSCMS version 4.7.0, specifically within the layerImage endpoint. The issue arises in the LayerImageController.Submit.cs file, where the function improperly handles user-supplied filePaths. This lack of proper validation allows for traversal sequences to be exploited, enabling access to files outside the designated upload directory. The vulnerability can be exploited remotely, and there is a public proof-of-concept available.

To address this vulnerability, implement the following measures: 1) Normalize paths to absolute canonical forms and enforce strict directory whitelists, 2) Replace user-supplied paths with server-generated file IDs or tokens, 3) Limit deletion operations to temporary files created by the server, 4) Validate file extensions, MIME types, and file signatures, and 5) Introduce security audit logs and regression tests for path traversal.