Vulnerability · Published Jul 6, 2026 · Assigned by INCIBE

CVE-2026-7185Unauthorized access to files in T-Systems products

Medium 6.0

In plain English

A medium-severity path traversal in Archivo from T-Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A validation vulnerability has been identified in certain web features related to file management or upload in several products of the TAO 2.0 suite. This vulnerability could allow an attacker capable of interacting with the affected feature to attempt to access file system resources outside the scope intended by the application.

Affected products (as reported)

Vendor	Product	Versions
T-Systems	Archivo	0 – before 2602.00
T-Systems	MyTAO	0 – before 2602.00
T-Systems	eStima	0 – before 2602.00
T-Systems	Buroweb	0 – before 2602.00

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/unauthorized-access-files-t-systems-products patch