CVE-2026-113395 | DrayTek Vigor2960 1.5.1.6 Revision 8218 swmconfigupload mainfunction.cgi cgiEscape multipart path traversal

October 20, 2026 Yanac

A vulnerability labeled as critical has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is known as CVE-2026-113395. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The affected component should be upgraded.

The vendor explains: “2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)”.VulDB Recent EntriesRead More