SonicWall NetExtender: Path Traversal Enables Root Write via tarball
CVE-2026-66152 Published on August 25, 2026
A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root.
Weakness Type
Path Traversal: '\..\filename'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Products Associated with CVE-2026-66152
Want to know whenever a new CVE is published for SonicWall Netextender? stack.watch will email you.
