Live › vulnerability › CVE-2026-9827
Go to dashboardAuthenticated path traversal in the boa web server's /boafrm/formUploadFile on the TOTOLINK X2000R. The uploaded filename is not validated, so '../' lets a logged-in user write any root-writable file, which leads to code execution. Talos reported it 2026-06-16; the vendor acknowledged it but no fixed firmware has been published. CVSS 9.1 (PR:H, so admin login is needed).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| X2000R | vendor | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-9827")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.