{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)",
          "vendor": "Wertheim GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014"
            }
          ]
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content."
    },
    {
      "lang": "es",
      "value": "El software Wertheim SafeController, AssemblyVersion 6.15.8328.28014, contiene una validaci\u00f3n insuficiente del tipo de archivo en el lado del servidor en el endpoint /safe/contract/uploadcustomdocuments. La aplicaci\u00f3n valida los archivos subidos bas\u00e1ndose en el valor HTTP Content-Type controlado por el usuario y acepta la subida si este valor contiene una cadena permitida como pdf, jpeg, tiff o png. Un atacante autenticado con cualquier rol o nivel de permiso puede falsificar el valor Content-Type y subir contenido de archivo arbitrario."
    }
  ],
  "id": "CVE-2026-34027",
  "lastModified": "2026-10-25T23:10:00.167",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34027",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-15T12:30:57.975922Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-15T12:16:25.203",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/wertheim"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://wertheim-safes.com/safe-deposit-box-management/"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Wertheim SafeController Software for VAULT ROOMS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260615-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Wertheim SafeController Software for VAULT ROOMS\n                     (Safe Deposit Locker System)\n vulnerable version: AssemblyVersion 6.15.8328.28014\n      fixed version: No information provided by vendor\n         CVE number: CVE-2026-34023, CVE-2026-34024, CVE-2026-34025,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2026-34026, CVE-2026-34027, CVE-2026-34028,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2026-34029, CVE-2026-34030\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://wertheim-safes.com/safe-deposit-box-management/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2023-04-03\n                 by: Christian Hager (Office Vienna)\n                     Gorazd Jank (Office Vienna)\n                     Philipp Espernberger (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"On September 1, 1852, Franz Wertheim and 85 employees began to build \"fireproof safes\".\nThen as now, Wertheim has been successfully involved in production of safes and banking\nfacilities, nationally and internationally. To secure the market position and develop\nnew business areas, Wertheim has continuously adapted its product range over the years\nas well as expanded its assortment of offerings. Today, the Wertheim Group of companies\nalso produces bank and object furnishings in our own joinery in Uttendorf, and\nCommissioned Work has developed into an essential business area for the group. The\ndiversity of state-of-the-art technologies characterizes the flexibility and technical\nknow-how of this division.\"\n\nSource:https://wertheim.at/en/company/ (2023)\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately. Specific version\ninformation was not provided. Please contact the vendor in order to request the\nupdate.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Violation of the Least-Privilege Principle\nThe application service is running in the context of a highly privileged user. An\nattacker managing to compromise the affected service, can run commands with\nthese privileges.\nThis vulnerability is not a direct Wertheim vulnerability but rather an installation\nproblem. However, due to the following issues, an attacker would be able to exploit\nthis problem and carry out actions with the permissions of the service account.\n\n2) Broken WebSocket Authorization (CVE-2026-34023)\nDue to flaws in the authorization scheme, an authorization bypass vulnerability\nallows an attacker to get access to restricted functions and resources in other\nbranches via the established WebSocket communication. To perform this attack an\nattacker has to be in the possession of valid user credentials of a low privileged\nbranch user.\n\n3) Broken access control (CVE-2026-34024)\nIn the tested system multiple endpoints where identified which do not perform\nauthorization checks. These endpoints may not be visible in the frontend but can\nbe accessed anyway. This enables authenticated users with minimal privileges to,\namong others, perform the following actions:\n* Switch the user\u0027s branch\n* Upload arbitrary files\n* Download arbitrary files\n* View details of an arbitrary branch\n\n4) IP Restriction Bypass (CVE-2026-34025)\nThe web application restricts user logins based on the specific IP address\nassociated to the branch\u0027s location. It was identified that the IP restriction\ncan be bypassed by manipulating HTTP requests during the login process.\n\n5) Path traversal (CVE-2026-34026)\nDue to insufficient application-side input validation, it is possible to\nrequest arbitrary files, accessible by the affected application, using a path\ntraversal attack. This includes but is not limited to application-specific\nlog files containing sensitive information. An existing session is required for\nthis attack. However, it does not matter which role or permissions the utilized\nuser possesses (see vulnerability 3).\n\n6) Upload Restriction Bypass (CVE-2026-34027)\nAs a result of insufficient application-side filetype validation it is possible\nto upload arbitrary files. An existing session is required to exploit this\nvulnerability. However, it does not matter which role or permissions the\nutilized user possesses (see vulnerability 3).\n\n7) Unauthenticated Access to Web Data (CVE-2026-34028)\nAn attacker has the ability to directly access HTTP endpoints which are not\nprotected by any authorization scheme. The attacker is able to directly\ndownload files and execute binaries which are stored on the specific file path.\n\n8) Hardcoded Secrets in DLL files (CVE-2026-34029)\nApplication components were identified storing sensitive data in an insecure\nnon-cryptographically protected format. An attacker with access to the application\nfiles can reverse engineer them and read out the hardcoded secrets.\n\n9) Insufficient input validation (CVE-2026-34030)\nWhen a new branch is added to a company the chosen branch code is not validated\ncorrectly and therefore malicious symbols can be injected into it. This enables\na malicious user to attack functions which actively use the branch code. The\nbranch code is used in multiple occasions. Possible attacks include, but are\nnot limited to, Cross-Site Scripting (XSS), path traversal attacks and all\ntypes of injections (OS Command, SQL, etc.).\nSpecial privileges (\"settings_branches_manage\") are needed to create a new\nbranch. Privileges can be elevated using the vulnerability described in\n3 and 5.\n\n10) Undisclosed Vulnerability\nThis vulnerability was identified during a reassessment commissioned by Wertheim.\nDetailed disclosure is withheld as the finding is subject to the vendor\u0027s ownership\nand disclosure authority. Affected parties are advised to contact the vendor\ndirectly for further information.\n\nThe combination of 3), 5), 6), 7) and 9) leads to an authenticated remote code\nexecution. If the service is running with high privileges (see 1), an attacker\nis able to fully compromise the whole server. The detailed proof-of-concept is\nshown in the chapter \"Attack Chain\" below.\n\n\nProof of concept:\n-----------------\n1) Violation of the Least-Privilege Principle\nTo verify the vulnerability, it is sufficient to search for the name \"Wertheim\nMessage Broker\" in the list of running services. This can be done e.g., by\nusing the \"Windows Task Manager\" and switching to the tab \"Services\". The tab\nshows the running services and visualizes, that the affected component is\nrunning in the context of the \"NT AUTHORITY/SYSTEM\" user.\n\nImage for Website PoC:\nRunning_Services.png\nCaption: Message Broker running with NT AUTHORITY/SYSTEM privileges\n\n\n2) Broken WebSocket Authorization (CVE-2026-34023)\nTo demonstrate this vulnerability, an attacker has to login into the application.\nAfter a successful login, a WebSocket channel is established using the following endpoint.\n\n```\nhttps:// \n[HOST]:16181/SafeController/WebMessageBroker/connect?transport=webSockets\u0026clientProtocol=1.5\u0026connectionToken=AQAAANC[...]\u0026connectionData=%5B%7B%22name%22%3A%22webmessagebroker%22%7D%5D\u0026tid=7\n```\n\nThe response indicates a switch to the WebSocket protocol.\n```\nHTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nServer: Microsoft-HTTPAPI/2.0\nAccess-Control-Allow-Origin: https://[HOST]\nAccess-Control-Allow-Credentials: true\nX-Content-Type-Options: nosniff\nConnection: Upgrade\nSec-WebSocket-Accept: o0uZzjFdLQsU7HLpJvSMRyyK1t8=\n```\n\nThe WebSocket channel is then used to send and receive messages between the server.\nFor example, if access to a specific safe and vault is granted via the web application,\na WebSocket message is sent to the server.\nTo give an example, opening vault 13 in branch 2 via the web application will send\nthe following WebSocket message to the server:\n\n```\n {\n    \"H\": \"webmessagebroker\",\n    \"M\": \"ActivateBox\",\n    \"A\": [\n        \"CTRL5400#Bank2\",\n        \"13\"\n    ],\n    \"I\": 8\n}\n```\n\nThe WebSocket message consists of two relevant parts:\n* Argument M: Describes the type of message. In this case \"ActivateBox\" is used to allow\n  opening a box.\n* Argument A: Consists of two sub arguments:\n  * \"CTRL5400#Bank2\": The ID of the controller. The first part describes the controller\n                      type and the second part the bank ID.\n  * \"13\": The ID of the box.\n\n\nAn attacker in possession of a valid controller ID (refer to vulnerability 3)\ncan insert it into the above WebSocket request and thereby perform actions\nin arbitrary branches. For example, the following WebSocket request is sent\nby a user from bank2 and the controller ID is defined as the ID of branch\n1. Additionally, it is passed as a parameter that box 1 is to be opened.\n\n```\n{\n    \"H\": \"webmessagebroker\",\n    \"M\": \"ActivateBox\",\n    \"A\": [\n        \"CTRL65000#Bank1\",\n        \"1\"\n    ],\n    \"I\": 3\n}\n```\n\nLogging into the application as user from Bank1 shows that the box has been\nsuccessfully activated.\n\n\n3) Broken access control (CVE-2026-34024)\nTo identify this issue a combination of the following research methods was performed:\n* Observing requests from users with elevated privileges and resending them,\n* Decompiling the software\n* Guessing endpoints.\n\nFor example, by decompiling the software some endpoints which do not have the\nPermissionFilter option set were identified as it can be seen in the following function.\n```\n// SafeSystem.Web.Areas.SysAdmin.Controllers.BranchController\n// Token: 0x06000DEA RID: 3562 RVA: 0x00028C98 File Offset: 0x00026E98\npublic ActionResult Details(int Id)\n{\n        this._sessionManagerService.SetCurrentBranchById(Id);\n        BranchViewModel branchViewModel = new BranchViewModel();\n        base.SetViewModelProperties(branchViewModel);\n[...]\n```\n\nThe following examples demonstrate the details on how to exploit the broken access\ncontrol issues.\n\n**Example 1: Switch the user\u0027s branch**\n\nDue to missing authorization filters, it is possible to switch branches and\ncompanies with the permission of a low privileged user. To demonstrate the\nissue, it is sufficient to open the following URL within an active session of any user.\n```\nhttps:// [HOST]/Dashboard/Home/ChangeBranch?branchId=2\n```\nThe parameter branchId is an identifier for the branch where the user wants to switch,\nand it is only an incremented value. To exploit this issue, it is sufficient to\nincrement the value until the right branch is reached.\n\nThe server response to this issue with an HTTP 302 message and forwards the user to\nthe dashboard of the new branch.\n\n```\nHTTP/2 302 Found\nCache-Control: public, no-store, max-age=0\nContent-Type: text/html; charset=utf-8\nExpires: Tue, 07 Mar 2023 09:18:38 GMT\nLast-Modified: Tue, 07 Mar 2023 09:18:38 GMT\nLocation: /dashboard\nVary: *\nServer: Microsoft-IIS/10.0\nX-Aspnetmvc-Version: 5.2\nX-Frame-Options: DENY\nX-Aspnet-Version: 4.0.30319\nX-Powered-By: ASP.NET\nDate: Tue, 07 Mar 2023 09:18:38 GMT\nContent-Length: 127\n\n\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eObject moved\u003c/title\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch2\u003eObject moved to \u003ca href=\"/dashboard\"\u003ehere\u003c/a\u003e.\u003c/h2\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\nIt\u0027s also possible to switch whole companies with following URL. The parameter\ncompanyId is also an incremented value which can be easily enumerated by an\nattacker.\n```\nhttps:// [HOST]/Dashboard/Home/ChangeCompany?companyId=2\n```\n\n**Example 2: Upload arbitrary files**\n\nDue to missing authorization filters, it is possible to store files persistently\non the system with any application user. To demonstrate the issue, it is\nsufficient to send the following POST request w"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/8"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://wertheim-safes.com/safe-deposit-box-management/"
        },
        {
          "url": "https://wertheim.at/en/company/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260615-0 :: Multiple Critical Vulnerabilities in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34023",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34024",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34025",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34026",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34027",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34028",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34029",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34030",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0340",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/8",
            "automated": true,
            "contentSha256": "34d24134677464b18285a181ecc5c3871b572dd0c08cce2e6944557f9090495a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-15T12:06:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0340"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T07:55:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0340"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-34027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-15T12:16:25Z",
    "severity": "MODERATE"
  },
  "details": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.",
  "id": "GHSA-gr5m-9xq3-vhc7",
  "modified": "2026-06-15T12:32:45Z",
  "published": "2026-06-15T12:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34027"
    },
    {
      "type": "WEB",
      "url": "https://r.sec-consult.com/wertheim"
    },
    {
      "type": "WEB",
      "url": "https://wertheim-safes.com/safe-deposit-box-management"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}