CVE-2026-11917 — ThinManager® - Path Traversal via API

CVE-2026-11917

ThinManager® - Path Traversal via API PUBLISHED

Description (CNA)

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

Affected (CNA)

Vendor / product	Versions
Rockwell Automation / FactoryTalk ThinManager	affected 13.0.0 – 13.0.7, 13.1.0 – 13.1.5, 13.2.0 – 13.2.4, 14.0.0 – 14.0.2

CWE

CWE-22

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1782.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.