---

Security Bulletin #26-005 - File Write via Policy Upload Allows Remote Code Execution

---

---

First published: 2026-04-16

Last updated: 2026-07-06

CVE: Not yet assigned

EUVD: Not yet assigned

CVSS Score: HIGH 8.2 - CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected product(s): DriveLock SE - DriveLock On-Premise

Affected deployment: DriveLock On-Premise only

DriveLock Cloud: Not affected

Disclosure status: Coordinated

Vulnerability type / classification: Arbitrary File Write / Path Traversal

Attack type: Remote

Attack vector: Network, requiring highest administrative privileges

---

Summary

A crafted policy can be used to place an executable file on the DES backend server, for example to install a backdoor.

Description

An attacker may upload a specially crafted policy package that results in files being written outside the intended target directory on the DES backend server. Successful exploitation may allow deployment of executable files and subsequent execution of arbitrary code. The attack is now prevented in two ways: user input is validated and checked for “..”. The ZIP library used has been adjusted so that extraction outside the target directory is no longer possible.

Affected versions

• DriveLock 24.2 — vulnerable

• DriveLock 25.1 — vulnerable

• DriveLock 25.2 — vulnerable

Mitigation

Update to DriveLock 26.1 once available.

Until the update is applied, ensure that Supervisor permissions are assigned only to trusted administrative users who require this level of access.

Fixed in

• DriveLock 26.1

Credits

This vulnerability was discovered by stuxxn working with CCC

How to update your environment

To ensure continued protection, update to the fixed version listed above. Additionally, we always recommend using the latest available DriveLock release to benefit from ongoing improvements and security enhancements.

---