CVE-2026-9108

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:36.00:::::::*

History

No history.

Information

Published : 2026-07-14 16:17

Updated : 2026-08-25 16:59

NVD link : CVE-2026-9108

Mitre link : CVE-2026-9108

CVE.ORG link : CVE-2026-9108

JSON object : View

Products Affected

rockwellautomation

studio_5000_logix_designer

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-9108", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9108", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:54:19.005009Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "PSIRT@rockwellautomation.com", "affectedData": [{"vendor": "Rockwell Automation", "product": "Studio 5000 Logix Designer", "versions": [{"status": "affected", "version": "V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T16:17:05.210", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html", "tags": ["Vendor Advisory"], "source": "PSIRT@rockwellautomation.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to improper limitation of file paths within ACD project files. The software does not\u00a0sanitize or\u00a0validate\u00a0file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution."}], "lastModified": "2026-08-25T16:59:52.783", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB77731A-DB59-4781-9C6F-0D79E3F58F8C", "versionEndExcluding": "32.05"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37EBBD32-B848-47A9-BFD7-C0637B8286B0", "versionEndExcluding": "33.04", "versionStartIncluding": "33.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EC5882B-9140-4687-91EF-25D99543F138", "versionEndExcluding": "34.04", "versionStartIncluding": "34.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0DDFE95-971B-4368-BAD5-7E6E7094454E", "versionEndExcluding": "35.02", "versionStartIncluding": "35.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:36.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "410696E5-C043-4096-9D8C-2988DCD8B24D"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT@rockwellautomation.com"}