Vulnerability Description
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dan-In-Ca | Sustainable Irrigation Platform | <= 5.2.16 |
Related Weaknesses (CWE)
References
- https://www.vulncheck.com/advisories/sustainable-irrigation-platform-path-traverThird Party Advisory
- https://www.zeroscience.mk/#/advisories/ZSL-2026-5996ExploitThird Party Advisory
FAQ
What is CVE-2026-60114?
CVE-2026-60114 is a vulnerability with a CVSS score of 7.5 (HIGH). Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary location...
How severe is CVE-2026-60114?
CVE-2026-60114 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-60114?
Check the references section above for vendor advisories and patch information. Affected products include: Dan-In-Ca Sustainable Irrigation Platform.