CVE-2026-46747 is a path traversal vulnerability (CWE-26) in Siemens SINEC INS affecting all versions before 1.0 SP2 Update 6. The vulnerability arises because the GET /api/sftp/uploadFiles endpoint fails to properly sanitize directory path input, enabling crafted requests to traverse directories and access files outside the intended scope. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality with limited data exposure but no integrity or availability impact.

An attacker with low privileges can exploit this vulnerability remotely over the network to read files outside the intended directory structure. The impact is limited to confidentiality as no integrity or availability effects are reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint to trusted users and monitor for suspicious activity related to directory traversal attempts.