CVE Feed

    Dashboard / CVE / CVE-2026-34027

    CVE-2026-34027

    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.

    Published:Jun 15, 2026
    Last Modified:Jun 23, 2026
    EPS:Jun 15, 2026
    EPSS Score:0.00305
    CVSS Score:5.3

    Affected Products

    Vendor
    Wertheim
    Product
    Safecontroller Software For Vault Rooms (safe Deposit Locker System)

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2026-34030 (CVSS 6.9) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the bran…
    CVE-2026-34029 (CVSS 6.8) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key…
    CVE-2026-34028 (CVSS 6.9) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that …
    CVE-2026-34026 (CVSS 7.1) — Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in …
    CVE-2026-34025 (CVSS 5.3) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulne…
    CVE-2026-34024 (CVSS 8.6) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks o…
    CVE-2026-34023 (CVSS 7.1) — The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vul…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High