Vulnerability · Published Jul 14, 2026 · Assigned by VulnCheck

CVE-2026-60114Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore

High 7.5

In plain English

A high-severity path traversal in SIP from Dan-in-CA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

Affected products (as reported)

Vendor	Product	Versions
Dan-in-CA	SIP	0 – through 5.2.16

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Zero Science Lab Advisory (ZSL-2026-5996) technical-description, exploit
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-path-traversal-via-json-backup-restore third-party-advisory