CVE-2026-22199 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi

What is CVE-2026-22199?

CVE-2026-22199 is a high-severity path traversal vulnerability in Voltronic Power SNMP Web Pro, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.

Weakness: CWE-22

Which versions are affected by CVE-2026-22199?

It affects 1 product.

Products include Gvectors Wpdiscuz.

How do I fix CVE-2026-22199?

No fix has been published for CVE-2026-22199 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-22199 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22199 exists.

Other vulnerabilities in Voltronic Power SNMP Web Pro

• CVE-2020-24186 File upload in n/a Critical 10.0
• CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider Critical 9.8
• CVE-2020-13640 SQL injection in n/a Critical 9.8
• CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() Critical 9.2
• CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qgvm-cj9x-53jj.