CVE-2026-60114 describes a path traversal vulnerability in Dan-in-CA SIP through version 5.2.16. The vulnerability arises because the restore process accepts JSON backup files with keys that are not validated before being used to construct file paths. This allows attackers to write files to arbitrary locations on the system. The issue is worsened by the absence of a required passphrase in the default configuration or the use of a default passphrase 'opendoor', enabling unauthenticated exploitation. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, no privileges required, no user interaction, and high impact on integrity.

An attacker can write arbitrary JSON files to any location on the system accessible by the SIP process, potentially leading to unauthorized file modification or code injection. This can compromise system integrity and may facilitate further attacks. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to enforce a strong passphrase configuration rather than relying on the default or no passphrase, and to restrict access to the restore functionality to trusted users only. Monitor vendor communications for official patches or updates.