CVE-2026-35077: high-severity vulnerability in MBS Double-A Profibus
Arbitrary file delete vulnerability in method ugw-delete-file
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A feature that deletes files doesn't properly check what files users are allowed to delete, letting attackers with regular user access remove important system files they shouldn't touch.
The ugw-delete-file method fails to validate or restrict file paths provided by authenticated users, allowing path traversal attacks to delete arbitrary files on the system. An attacker with valid user credentials can exploit insufficient input validation to access and remove files outside intended directories.
In the same product, most dangerous first.