Skip to content
Fencer Vulns
medium 4.8

CVE-2026-76652 json

Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600

published 2026-09-10 59 d ago modified 2026-09-11 59 d ago also EUVD-2026-75727

cvss
4.8
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory.

Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.

Patch / fix

  • TP-Link Systems Inc. TL-MR6400 v8 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
  • TP-Link Systems Inc. Archer MR600 MR600(EU)_V2_1.12.0 Build 2600826, MR600(EU)_V3_1.4.0 Build 260827, MR600(EU)_V5_1.9.0 Build 260805

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
59 d ago

Exploit prediction

0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 4.8 CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 4.8 CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • TP-Link Systems Inc. TL-MR6400 v8
  • TP-Link Systems Inc. Archer MR600

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.