Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

SINEC INS: Unauthorized Command Execution via Malicious Directory Names

CVE-2026-46746 · published 4 months ago
Summary

SINEC INS versions before V1.0 SP2 Update 6 are at risk of unauthorized command execution. An authenticated attacker can upload malicious files and execute arbitrary commands on the system with the privileges of the service user. To mitigate this risk, update to version V1.0 SP2 Update 6 or later.

Original advisory text
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the inject...
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published9 Jun 2026
Updated4 Nov 2026
First seen9 Jun 2026
Sources
CVE-2026-46746 · NVD
Track software like this
Free during beta