CVE-2026-18192 is a relative path traversal vulnerability (CWE-23) in the Vacron VIN-DS783E-E6 product. This flaw allows authenticated remote attackers to perform arbitrary file reads by exploiting improper validation of file path inputs, enabling them to download arbitrary system files from the affected system. The vulnerability has been assigned a CVSS 4.0 score of 7.1, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with authentication privileges can leverage this vulnerability to read arbitrary files on the system, potentially exposing sensitive information. The confidentiality of the system is highly impacted, but integrity and availability are not affected according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the vulnerable service to untrusted networks.