Ziostation2 Path Traversal Exposes Sensitive OS Info

The National Vulnerability Database (NVD) has documented CVE-2026-40062, a critical path traversal vulnerability impacting Ziostation2 versions 2.9.8.7 and earlier. This flaw, rated with a CVSS score of 7.5 (HIGH), allows a remote, unauthenticated attacker to access sensitive information on the underlying operating system.

The core issue, categorized as CWE-22 (Path Traversal), enables attackers to bypass directory restrictions and access arbitrary files. For Ziostation2 users, this means a threat actor could potentially exfiltrate configuration files, user data, or system credentials without needing any prior authentication, leading to significant data exposure and potential further compromise.

This vulnerability highlights the persistent risk of fundamental input validation failures. CISOs and security teams must recognize that even seemingly minor traversal flaws can lead to severe information disclosure, providing attackers with the intelligence needed for deeper network penetration. Defenders need to assume unauthenticated access is a constant threat vector.