PatchSiren

Penta Security Systems CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Penta Security Systems CVE published 2026-10-22

CVE-2022-51025

A path traversal vulnerability exists in Penta Security WAPPLES versions 4.0.54.1, 5.0, and 6.0, allowing authenticated attackers to download arbitrary files via the /webapi/file/transfer endpoint. The vulnerability can be exploited by sending GET requests with type=db_backup and ../ sequences in the name parameter to read files like /etc/passwd. A hardcoded systemi account makes authentication effectivel [truncated]