CVE-2026-60114 describes a path traversal vulnerability in Dan-in-CA SIP through version 5.2.16. The vulnerability arises from improper validation of keys in JSON backup files during the restore process, allowing attackers to manipulate file paths and write arbitrary JSON files outside the designated data directory. The lack of a mandatory passphrase or reliance on a default passphrase 'opendoor' further facilitates exploitation without authentication. This vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity and network exploitable without privileges or user interaction.

An unauthenticated attacker with access to the restore functionality can write arbitrary files to any location on the system where the SIP software runs. This can lead to unauthorized modification or creation of files, potentially compromising system integrity or enabling further attacks. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the restore functionality to trusted users only and avoid using the default passphrase 'opendoor'. Implement additional validation or filtering on JSON backup files before restoration to prevent path traversal. Monitor vendor communications for updates on patches or official mitigations.