What is GHSA-4hjx-4cg8-m339?

GHSA-4hjx-4cg8-m339 is a security advisory published by GitHub Security Advisories with High severity. Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web...

Which CVE IDs does GHSA-4hjx-4cg8-m339 cover?

GHSA-4hjx-4cg8-m339 covers the following CVE IDs: CVE-2026-95378. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-4hjx-4cg8-m339High

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-95378 →

📋 Description

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.

This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-95378
https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf
https://github.com/advisories/GHSA-4hjx-4cg8-m339