This vulnerability (CVE-2026-76652) involves improper limitation of a pathname to a restricted directory (CWE-22) in the file upload feature of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 routers. Due to insufficient validation of user-supplied file paths, an authenticated remote attacker can perform directory traversal to write files outside the intended upload directory. This can result in overwriting or modifying files accessible by the affected service. No arbitrary code execution has been demonstrated. The CVSS 4.0 vector indicates the attack requires local network access with high privileges and no user interaction.

An authenticated remote attacker with access to the upload functionality can write files outside the intended directory, potentially overwriting or modifying files used by the affected service. This could disrupt service operation or integrity but does not currently demonstrate code execution or privilege escalation.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to the upload functionality and monitor for suspicious file uploads.