Security readout for executives and security teams
Plain-English summary
An unauthenticated internet-reachable attacker may abuse Datiphy Data Management Center’s upload API to place files outside the intended folder. This could alter application or system data and disrupt operations. The supplied record rates the issue critical, but does not establish active exploitation or identify a confirmed patch.
Executive priority
Treat this as an immediate investigation and containment priority, especially for internet-facing systems. Identify deployments, restrict upload access, and seek vendor remediation guidance. Escalate any evidence of unexpected file placement or configuration changes to incident response.
Technical view
CVE-2026-76158 is a CWE-73 path-control flaw. Relative or absolute path sequences supplied to the upload API can redirect file writes outside the upload directory. CVSS 4.0 scores it 9.3, with network access, low complexity, no privileges, and no user interaction. Actual impact depends on writable locations and service permissions.
Likely exposure
The narrative identifies Data Management Center v8.3.0 through v8.5.1 as affected. However, the structured affected entry lists only v8.3.0 and is internally inconsistent with a default status of unaffected. Organizations using any release in the stated range should investigate exposure and obtain vendor confirmation.
Exploitation context
The supplied bundle does not identify CVE-2026-76158 as a CISA KEV and provides no cited evidence of active exploitation. Exploit availability and real-world targeting therefore remain unknown. The unauthenticated, network-accessible upload path and critical score nevertheless make exposed deployments attractive targets.
Researcher notes
The central primitive is attacker-controlled destination-path resolution during upload. The sources do not describe authentication controls, filename sanitization behavior, writable targets, patch versions, public proof-of-concept availability, or observed attacks. Version metadata is inconsistent, so affected-range confirmation is important before closing findings.
Mitigation direction
- Check Datiphy guidance for corrected versions or vendor-approved mitigations.
- Restrict the upload API to trusted networks and authenticated access where operationally possible.
- Disable the affected upload function if it is unnecessary and can be safely removed from service.
- Limit the application service account’s filesystem write permissions.
- Prioritize internet-facing deployments for containment and remediation.
Validation and detection
- Inventory Data Management Center deployments and record their exact versions.
- Determine whether the upload API is reachable from untrusted networks.
- Review filesystem permissions granted to the application service account.
- Inspect upload and filesystem logs for unexpected paths or writes.
- Confirm remediation status against current Datiphy guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-76158 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H——ZUSO ARTVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://zuso.ai/advisoryCVE reference, ZUSO ART · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.