CVE-2026-60114 Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore

High 8.7 Published 14 Jul 2026 Updated 14 Jul 2026

Attackers can write arbitrary files via path traversal in JSON backup restore, potentially leading to code execution or data modification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-60114?

CVE-2026-60114 is a high-severity path traversal vulnerability in Dan-in-CA SIP, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

Weakness: CWE-22

Which versions are affected by CVE-2026-60114?

It affects 1 product.

Products include Dan-in-Ca Sustainable Irrigation Platform.

How do I fix CVE-2026-60114?

No fix has been published for CVE-2026-60114 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-60114 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-60114 exists.

Sources

Also known as AZL-92370, GHSA-9xpx-72mq-c8x9.