CVE-2026-36500 describes a directory traversal vulnerability (CWE-22) in the cluster-admin:backup-datastore component of Controller v12.0.5. Attackers can exploit this issue by sending specially crafted requests that bypass intended file path restrictions, enabling access to arbitrary files outside the designated directory. The vulnerability is remotely exploitable without privileges or user interaction, resulting in high confidentiality impact and denial of service conditions. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to unauthorized reading of files outside the intended directory scope, compromising confidentiality. Additionally, the vulnerability can cause denial of service, impacting availability. Integrity impact is not indicated. The vulnerability is remotely exploitable without authentication or user interaction, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected component and monitor for suspicious requests targeting directory traversal patterns. Avoid exposing the cluster-admin:backup-datastore interface to untrusted networks.