CVE-2026-90445

CVE-2026-90445 is a path-traversal flaw (CWE-22, commonly known as 'Zip Slip') in the file-upload interface of an unspecified product: the software extracts uploaded archives without verifying that extracted entry paths stay within the intended destination directory. An authenticated user can trigger it by uploading a crafted archive whose entries traverse outside the destination folder, causing files to be written to arbitrary locations with the privileges of the extraction process. Per the CVSS 4.0 score of 7.1 (High), exploitation requires only network access and low privileges (i.e., a valid authenticated account), and the impact is high to integrity — an attacker can inject fabricated records into stored data or tamper with application configuration — with no confidentiality or availability impact scored. The affected vendor, product, and version range are not named in the available data; the CVE was assigned by CISA ICS-CERT, indicating an industrial control system or similarly scoped operational-technology product. There is currently no known exploitation: the flaw is not in CISA's KEV catalog and no public proof-of-concept exists.

What to do: No fixed version is identified in the available data, so monitor CISA ICS-CERT advisories and the vendor's release channel for a patch addressing CVE-2026-90445. Until a fix is available, restrict archive-upload functionality to the smallest set of trusted authenticated accounts and audit the destination area (and application configuration/data stores) for unexpected files, altered configuration, or fabricated records that would indicate abuse. On remediation, confirm the vendor validates or sanitizes archive entry paths before extraction.