CVE-2026-25872 MEDIUM

CVE-2026-25872: JUNG Smart Panel 5.1 KNX Unauthenticated Path Traversal

Vendor Albrecht Jung Gmbh & Co. Kg
Product JUNG Smart Panel 5.1 KNX
Weakness CWE-22 · Path traversal
Published February 10, 2026
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interface. The application fails to properly validate file path input, allowing remote, unauthenticated attackers to access arbitrary files on the underlying filesystem within the context of the web server. This may result in disclosure of system configuration files and other sensitive information.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
May 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-45026 QTS, QuTS hero, QuTScloud CVE-2025-7640 hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion CVE-2026-46491 SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion CVE-2026-34657 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CVE-2022-4493 scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversal