OpenCVE

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Watchguard	Fireware Os

No data.

No data.

References

Link	Providers
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028

History

Mon, 06 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 02 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Description		A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Title		WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI
First Time appeared		Watchguard Watchguard fireware Os
Weaknesses		CWE-22
CPEs		cpe:2.3:a:watchguard:fireware_os::::::::11.0 cpe:2.3:a:watchguard:fireware_os::::::::12.0 cpe:2.3:a:watchguard:fireware_os::::::::12.5 cpe:2.3:a:watchguard:fireware_os::::::::2025.1
Vendors & Products		Watchguard Watchguard fireware Os
References		https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2026-07-02T23:07:57.548Z

Updated: 2026-07-07T03:56:23.074Z

Reserved: 2026-06-23T17:55:06.157Z

Link: CVE-2026-13054

Vulnrichment

Updated: 2026-07-06T15:45:40.439Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13054", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-06-23T17:55:06.157Z", "datePublished": "2026-07-02T23:07:57.548Z", "dateUpdated": "2026-07-07T03:56:23.074Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThanOrEqual": "11.12.4+541730", "status": "affected", "version": "11.0", "versionType": "semver"}, {"lessThanOrEqual": "12.12", "status": "affected", "version": "12.0", "versionType": "semver"}, {"lessThanOrEqual": "12.5.18", "status": "affected", "version": "12.5", "versionType": "semver"}, {"lessThanOrEqual": "2026.2", "status": "affected", "version": "2025.1", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0", "versionEndIncluding": "11.12.4+541730", "versionStartIncluding": "11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0", "versionEndIncluding": "12.12", "versionStartIncluding": "12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5", "versionEndIncluding": "12.5.18", "versionStartIncluding": "12.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1", "versionEndIncluding": "2026.2", "versionStartIncluding": "2025.1", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Nicholas Zubrisky (@NZubrisky) of TrendAI Research"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.</div><div><br></div><div>This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.</div>"}], "value": "A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.\n\n\n\n\nThis vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2."}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.6, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-07-02T23:07:57.548Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028"}], "source": {"advisory": "WGSA-2026-00028", "defect": ["FBX-33176"], "discovery": "EXTERNAL"}, "title": "WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-13054"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T03:56:23.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T15:45:36.503502Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T15:45:40.439Z"}}], "cna": {"title": "WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI", "source": {"defect": ["FBX-33176"], "advisory": "WGSA-2026-00028", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Nicholas Zubrisky (@NZubrisky) of TrendAI Research"}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.12.4+541730"}, {"status": "affected", "version": "12.0", "versionType": "semver", "lessThanOrEqual": "12.12"}, {"status": "affected", "version": "12.5", "versionType": "semver", "lessThanOrEqual": "12.5.18"}, {"status": "affected", "version": "2025.1", "versionType": "semver", "lessThanOrEqual": "2026.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.\n\n\n\n\nThis vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.", "supportingMedia": [{"type": "text/html", "value": "<div>A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.</div><div><br></div><div>This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0", "vulnerable": true, "versionEndIncluding": "11.12.4+541730", "versionStartIncluding": "11.0"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0", "vulnerable": true, "versionEndIncluding": "12.12", "versionStartIncluding": "12.0"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5", "vulnerable": true, "versionEndIncluding": "12.5.18", "versionStartIncluding": "12.5"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1", "vulnerable": true, "versionEndIncluding": "2026.2", "versionStartIncluding": "2025.1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-07-02T23:07:57.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13054", "state": "PUBLISHED", "dateUpdated": "2026-07-06T15:45:44.035Z", "dateReserved": "2026-06-23T17:55:06.157Z", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "datePublished": "2026-07-02T23:07:57.548Z", "assignerShortName": "WatchGuard"}, "dataVersion": "5.2"}