CVE-2026-85114: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Siemens .NET Client Library for SIMATIC S7 Webserver API

This vulnerability (CWE-22) exists in the .NET Client Library for SIMATIC S7 Webserver API from Siemens, affecting all versions before 3.3.61. The issue arises because the application fails to properly validate filenames received from remote servers during ticket downloads. An attacker capable of manipulating the ticket response can exploit this to perform path traversal, writing files outside the designated directory and overwriting files accessible to the application if overwriting is enabled. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, no privileges required, no user interaction, and impact limited to integrity.

An attacker who can manipulate the ticket response can write arbitrary files outside the intended download directory, potentially replacing existing files accessible to the application if overwriting is enabled. This compromises the integrity of the system but does not affect confidentiality or availability according to the CVSS vector.

A fix is available in version 3.3.61 of the .NET Client Library for SIMATIC S7 Webserver API. Users should upgrade to version 3.3.61 or later to remediate this vulnerability. Patch status is confirmed by the affectedVersions data indicating versions prior to 3.3.61 are vulnerable.