PowerStore Path Traversal via Service User Enables Local File Modification
CVE-2026-28265 Published on April 1, 2026

PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.

NVD

Vulnerability Analysis

CVE-2026-28265 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

LOW

Availability Impact:

LOW

Weakness Type

Path Traversal: '.../...//'

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Affected Versions

Dell PowerStore:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 500T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 1000T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 1200T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 3000T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 3200Q:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 3200T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 5000T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 5200Q:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 5200T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 7000T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 9000T:

Before 4.4.0.0-2692403 or later is affected.

Dell PowerStore 9200T:

Before 4.4.0.0-2692403 or later is affected.

Exploit Probability

EPSS

0.01%

Percentile

1.73%