A critical path traversal vulnerability in the Welotec SmartEMS Web Application allows authenticated attackers to achieve remote code execution via arbitrary file writes.

This is a path traversal vulnerability (CWE-22) occurring within the upload endpoint. An authenticated attacker can manipulate the Upload-Key header to write files outside the intended directory, which may result in remote code execution.

The ability for an attacker to write arbitrary files to the server presents a severe risk to system integrity and confidentiality. Given the CVSS score of 8.8, this vulnerability is classified as High severity, as it provides a pathway for a malicious actor to gain control over the application environment and potentially pivot deeper into the internal network.

Immediate Action: Update the Welotec SmartEMS Web Application to version 3.3.6 or later to ensure the upload endpoint correctly validates the Upload-Key request header.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, targeting the upload functionality.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing directory traversal characters directed at the upload service.

Public Exploit Available: No — there is no confirmed public exploit available.

The severity of this vulnerability necessitates immediate attention from security administrators. Organizations utilizing the Welotec SmartEMS Web Application must prioritize updating to the fixed version to prevent potential remote code execution. If an immediate update is not feasible, restrict access to the affected upload endpoint to trusted administrative accounts only until the patch is applied.