CVE-2026-5491 - DriveLock Directory Traversal Information Disclosure Vulnerability

Back Back to CVE browser

HIGH

DriveLock Directory Traversal Information Disclosure Vulnerability

Published Jul 29, 2026

7.5

HIGH

CVSS 3.0

EPSS 1.83%

Description

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 6067 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28722.

Affected products

Vendor DriveLock Product DriveLock Default
n/a
- Version
  25.2.2.61370
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

DriveLock

n/a

Version	Status	Constraints
25.2.2.61370	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50495
Advisory
https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm
vendor-advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-287/
x_research-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50495		Advisory
https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm		vendor-advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-287/		x_research-advisory