CVE-2026-76158: CWE-73 External control of file name or path in Datiphy Inc. Data Management Center

The vulnerability identified as CVE-2026-76158 in Datiphy Data Management Center versions 8.3.0 through 8.5.1 involves external control of file name or path (CWE-73) in the upload API endpoint. An attacker can supply relative or absolute path sequences to write files outside the designated upload directory, potentially leading to unauthorized file system modifications. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker to write arbitrary files outside the intended upload directory, which can compromise system integrity and potentially lead to further attacks or system compromise. The vulnerability does not require authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Datiphy Inc.'s advisories for updates. Until a fix is available, restrict access to the upload API endpoint and validate or sanitize file path inputs to prevent exploitation.