CVE-2026-90925

Executive Summary

CVE-2026-90925 is a path traversal (CWE-22) vulnerability in Logsign SIEM, a commercial security information and event management platform from Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Versions from 6.4.101 up to (but not including) 6.4.117 are affected, and exploitation requires only a low-privileged, network-reachable account (CVSS 3.1: 7.1, AV:N/AC:L/PR:L). A successful attack allows an authenticated user to write files outside the intended restricted directory, yielding high integrity impact (I:H) with a limited availability impact (A:L) and no direct confidentiality impact (C:N).

Technical Analysis

The core defect is CWE-22, Improper Limitation of a Pathname to a Restricted Directory, commonly referred to as path traversal or directory traversal. The vulnerability arises when user-controlled input that forms part of a filesystem path is not adequately canonicalized or constrained to a permitted base directory, allowing an attacker to supply traversal sequences (for example ../) or absolute paths to escape that directory.

From the data available, the following can be stated with confidence:

• The flaw is network-accessible (CVSS AV:N), meaning it is reachable through a listening service or web-facing component rather than requiring local shell access.
• The attack is low complexity (AC:L) and requires no user interaction (UI:N), indicating no victim has to click a link or open a file — the attacker acts directly.
• The attacker must be authenticated with at least low privileges (PR:L). This is significant: this is not a pre-authentication vulnerability. The threat actor must already hold a valid account, which raises the bar versus unauthenticated traversal flaws but is easily met in environments with self-registration, shared service accounts, or compromised low-privilege credentials.
• Scope is unchanged (S:U), so the vulnerable component's exploitation does not cross a security authority boundary in CVSS terms.
• The impact profile (C:N / I:H / A:L) is highly characteristic of a write-side path traversal. The absence of confidentiality impact strongly suggests the traversal is used to place or overwrite a file in an unintended location rather than to read arbitrary files. The high integrity impact reflects that attacker-controlled content can be written to a location the attacker should not control; the partial availability impact reflects that the affected functionality may become unavailable (for example, through overwriting a file or exhausting disk).

The most common mechanism for a write-side traversal in a SIEM or web application context is an upload, import, log-ingestion, configuration, or report-generation feature that accepts a filename or path component from the client and constructs a destination path with it. However, no specific endpoint, parameter name, function name, or file path is disclosed in the NVD description or CNA title.

Insufficient technical detail is available to identify the exact vulnerable component. The NVD description confirms only the vulnerability class (CWE-22), the vendor/product (Logsign SIEM), the affected version range (6.4.101 to before 6.4.117), and that path traversal is possible. Statements about the precise traversal target — whether it enables writing a web-accessible file, overwriting a configuration file, or moving a file to a sensitive directory — are not supported by the provided data.

The attack surface is any Logsign SIEM interface reachable with a low-privileged session that accepts client-supplied path or filename data. Because Logsign SIEM typically ingests, indexes, and stores log and event data and exposes search, reporting, and administrative web interfaces, the practical attack surface is broad, but each concrete surface must be confirmed by the operator in their own deployment.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class (CWE-22 path traversal) and the CVSS impact profile. No specific endpoint, parameter, or file path is invented.

1. Reconnaissance / target identification. The attacker identifies a network-reachable Logsign SIEM instance, e.g., via Shodan or internal network scanning, and determines the running version (the affected range is 6.4.101 to before 6.4.117). The attacker obtains or already holds a low-privileged account. Because the vulnerability is post-authentication (PR:L), credential acquisition — phishing, credential reuse, an over-provisioned service account, or a separate low-severity flaw — is a prerequisite.

2. Triggering the flaw class. With a valid low-privileged session, the attacker locates a feature that accepts a path or filename that the server later uses to construct a filesystem destination. In a path traversal of the write variety, the attacker supplies input containing traversal sequences (e.g., ../) or an absolute path in place of the expected value. The weakness exists because the application fails to canonicalize the resulting path and verify it remains inside the intended restricted directory (CWE-22). No user interaction is required (UI:N); the attacker can attempt the request directly.

3. Payload / execution method (class level). The attacker writes attacker-controlled content to a path outside the intended directory. Because the CVSS confidentiality impact is None, the primary demonstrated effect is placing or overwriting files, not reading them. The severity (I:H) implies the write can reach a location that meaningfully changes application state or behavior. Whether the written content can be subsequently executed or rendered is not established by the available data and must not be assumed.

4. Post-exploitation impact. The high integrity impact supports scenarios in which attacker-written files alter or replace legitimate data, tamper with stored content, or affect the application's behavior. The partial availability impact (A:L) supports scenarios in which the affected functionality or the targeted file becomes unavailable after the write. Combined, an authenticated attacker can degrade trust in the SIEM's data and, depending on the target location, potentially affect the platform's operation. Any claim of remote code execution, privilege escalation, or lateral movement would be speculative and is not supported by the provided data.

Impact Assessment

• Confidentiality (C:N): No direct confidentiality impact per the CVSS vector. The available evidence does not support arbitrary file read.
• Integrity (I:H): High. The defining risk of this CVE is that attacker-controlled content can be written outside the permitted directory, altering data or files the attacker should not control.
• Availability (A:L): Partial. The affected functionality may become unavailable as a consequence of the write.
• Attack vector (AV:N): Exploitable over the network.
• Attack complexity (AC:L): No special conditions; straightforward to attempt.
• Privileges required (PR:L): A low-privileged authenticated account is required.
• User interaction (UI:N): None required.
• Scope (S:U): Impact is confined to the vulnerable component's security authority in CVSS terms.

Business impact. Logsign SIEM is a system of record for security telemetry: authentication logs, network events, and audit trails. Integrity compromise of a SIEM is disproportionately damaging because downstream alerting, compliance reporting, and forensic investigation all depend on the trustworthiness of that data. An attacker able to write outside the restricted directory may be able to corrupt, tamper with, or suppress evidence, undermining detection and incident response precisely when it is most needed.

Blast radius. Any Logsign SIEM instance in the affected version range with a low-privileged account and a reachable traversal-capable interface. Because the flaw is post-authentication, blast radius is bounded by the ability to obtain a low-privilege session, but is otherwise broad across an organization's SIEM deployment.

Threat prioritization. CVSS 7.1 (High). No EPSS score is published by FIRST.org, no public exploit code or PoC exists, and the CVE is not in CISA KEV. Current exploitation likelihood is assessed as low-to-moderate, driven by the post-authentication requirement, but the business impact of SIEM integrity compromise is high, so the vulnerability warrants prompt remediation.

Detection Guidance

Sigma Rule

title: Logsign SIEM Path Traversal Attempt (CVE-2026-90925)
id: 7c1d4f2a-9b3e-4e21-8a6f-0d5b2e9c1a44
status: experimental
description: Detects HTTP requests containing path traversal sequences consistent with CWE-22 exploitation attempts against Logsign SIEM.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90925
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: logsign
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
  selection_nullbyte:
    cs-uri-query|contains:
      - '%00'
      - '%2500'
  condition: selection_method and (selection_traversal or selection_nullbyte)
falsepositives:
  - Legitimate applications that embed relative path strings in query parameters
level: medium
tags:
  - attack.t1005
  - attack.t1083
  - cve.2026.90925

YARA Rule

rule CVE_2026_90925_Logsign_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting Logsign SIEM (CWE-22)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90925"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $trav1 = "../" ascii nocase
        $trav2 = "..\\" ascii nocase
        $trav3 = "..%2f" ascii nocase
        $trav4 = "%2e%2e%2f" ascii nocase
        $trav5 = "%2e%2e%5c" ascii nocase
        $trav6 = "....//" ascii nocase
        $nullbyte = "%00" ascii

    condition:
        filesize < 512KB and
        ( 2 of ($trav*) or any of ($trav*) and $nullbyte )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90925 Logsign SIEM Path Traversal Attempt (CWE-22)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"../"; nocase; reference:cve,2026-90925; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90925; classtype:web-application-attack; sid:2026909251; rev:1;)

alert http any any -> any any (msg:"CVE-2026-90925 Logsign SIEM Path Traversal Encoded Attempt"; flow:established,to_server; http.uri; content:"%2e%2e%2f"; nocase; reference:cve,2026-90925; classtype:web-application-attack; sid:2026909252; rev:1;)

alert http any any -> any any (msg:"CVE-2026-90925 Logsign SIEM Path Traversal Backslash Attempt"; flow:established,to_server; http.uri; content:"..%5c"; nocase; reference:cve,2026-90925; classtype:web-application-attack; sid:2026909253; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      url.query like~ "*../*" ]
  [ network where network.protocol == "http" and
      url.query like~ "*%2e%2e%2f*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, url, cs_uri_query)
| where match(uri, "(?i)(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|\.\.%2f|\.\.%5c)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, host
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="logsign,web,attack,">
  <rule id="100925" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</field>
    <description>CVE-2026-90925: Logsign SIEM path traversal attempt detected in request URL</description>
    <mitre>
      <id>T1005</id>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_90925,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit, or release note confirming a fix is present in the tracked data. The CNA version statement indicates affected versions are from 6.4.101 up to before 6.4.117, which implies 6.4.117 as the closing bound; this must be independently verified with the vendor before relying on it. Treat the situation as unpatched until confirmation is obtained.

1) Immediate mitigations:

• Restrict network access to Logsign SIEM interfaces to trusted management networks and authorized source addresses; do not expose the platform directly to the public internet.
• Enforce least privilege on Logsign accounts. Because PR:L is required, reducing the number of low-privileged accounts and eliminating shared or default accounts directly reduces attack surface.
• Enforce MFA on all accounts that can reach traversal-capable interfaces.
• Deploy the detection rules above (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) and alert on repeated traversal attempts from a single identity or source.
• Monitor writes to unintended filesystem locations and file-integrity baselines; investigate unexpected file creation or modification.
• Apply a reverse proxy / WAF in front of Logsign with rule-based rejection of ../, encoded traversal, and null-byte sequences in URLs, request parameters, and upload filenames.

2) Patch/upgrade steps:

• Contact the vendor to confirm the exact fixed version and obtain a signed advisory. Do not assume 6.4.117 is verified.
• Once a fix is confirmed, schedule an upgrade from affected versions (6.4.101 up to before 6.4.117) to the confirmed fixed release.
• Back up configuration and log data before upgrading and validate function after upgrade.
• If no fixed release is available, hold at a hardened configuration with the mitigations above and monitor.

3) Long-term hardening:

• Sanitize and canonicalize all filesystem paths server-side: resolve to an absolute path, reject traversal and null bytes, and verify the resolved path remains inside the intended base directory.
• Never construct destination paths from client-supplied input; where unavoidable, allowlist accepted values.
• Add file-integrity monitoring (FIM) on SIEM data and configuration directories.
• Segment SIEM infrastructure from general user networks.
• Institute a routine vulnerability management cycle covering SIEM components and their dependencies.
• Maintain and test detection content for the CWE-22 class, not just this single CVE.

References

• NVD — CVE-2026-90925: https://nvd.nist.gov/vuln/detail/CVE-2026-90925
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• FIRST.org EPSS (CVE-2026-90925 — currently unscored): https://api.first.org/data/v1/epss?cve=CVE-2026-90925
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-90925 not listed as of the reporting date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Logsign vendor site — advisory not yet published in tracked sources: https://www.logsign.com

Threat actor / in-the-wild evidence: None. No public PoC, no exploit code, no Nuclei template, no EPSS score, and no CISA KEV listing are associated with CVE-2026-90925 in the provided data. No threat actor campaigns are known.