CVE-2026-9550
Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 26, 2026
- Updated
- May 26, 2026
- Reserved
- May 26, 2026
Description
A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. Affected by this issue is some unknown functionality of the file /SubstationWEBV2/app/..;/main/upfile. Executing a manipulation of the argument path can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
EEMS Enterprise Power Operation and Maintenance Cloud PlatformAcrel Electrical |
|
References
- VDB-365609 | Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversalvdb-entrytechnical-description
- VDB-365609 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #815455 | Acrel Electric Co., Ltd. EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 Unrestricted File Uploadthird-party-advisory
- https://ucn9h68n9289.feishu.cn/wiki/FC6swHuyqiLVyfkwKcNc8sCjnfbexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.