---
id: "CVE-2026-122013"
kind: "vulnerability"
aliases: ["CVE-2026-122013"]
title: "Comfast CF-WR632AX router: remote path traversal via multipart upload filename"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CF-WR632AX", "fixed": [], "affected": "2.6.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cf-wr632ax", "comfast", "firmware", "home-network", "infrastructure", "router"]
not_affected_if: ["admin-interface-not-reachable", "other-firmware-versions"]
published_at: "2026-11-04T21:18:07+00:00"
first_seen_at: "2026-11-04T21:49:18+00:00"
updated_at: "2026-11-04T21:51:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122013", "first_seen_at": "2026-11-04T21:49:18+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/431080", "first_seen_at": "2026-11-04T21:51:25+00:00", "cites": ["https://vuldb.com/vuln/431080", "https://nvd.nist.gov/vuln/detail/CVE-2026-122013"]}]
exploit_sources: []
---

# Comfast CF-WR632AX router: remote path traversal via multipart upload filename

VulDB reports that /usr/bin/webmgnt on Comfast CF-WR632AX 2.6.0.1 does not sanitise the filename in multipart uploads (path traversal, CWE-22). The submitter's title says unauthenticated arbitrary file write; VulDB says no authentication is required and a proof-of-concept exists. The vendor did not respond and no fix or mitigation is known. No in-the-wild exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CF-WR632AX affected 2.6.0.1 fixed ?

## How to check

- Log in to the router admin page and read the firmware version; 2.6.0.1 is the only version named as affected (other builds are untested, not confirmed safe)
- Check whether the web management interface (nginx/webmgnt) answers from the WAN side or from untrusted networks; VulDB says no authentication is needed, so any network that can reach it can attack it
- No vendor fix or countermeasure is known: restrict admin access to a trusted LAN, disable remote management, or replace the device

## Timeline

- 2026-11-04T21:49:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122013
- 2026-11-04T21:51:25+00:00 analyst https://vuldb.com/vuln/431080 — Only VulDB (CNA) and NVD found; no vendor page, so nothing verified. VulDB: unauthenticated, PoC public (github link hidden behind paywall), vendor silent, no countermeasure. Not checked: X (skipped), PoC repo not located.

## Documents

- [describes] VulDB VDB-431080: Comfast CF-WR632AX 2.6.0.1 webmgnt filename path traversal https://vuldb.com/vuln/431080
- [mentions] NVD CVE-2026-122013 https://nvd.nist.gov/vuln/detail/CVE-2026-122013

## From the sources

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_