PatchTheCVECVE-2026-12339: A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted arch
35
Routine
MEDIUM 6.9
CVE-2026-12339 is a medium-severity flaw (CVSS 6.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.9 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-08-10 |
| Last modified | 2026-10-23 |
Publisher (CNA): TPLink
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source
sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.