CVE-2026-0651

published 2026-02-10

CVE-2026-0651: A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server…

Priority P3 49 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root.

Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
tp-link	tapo_c260_firmware	< 1.1.9	1.1.9
tp-link_systems_inc	tapo_c260_v1	< 1.1.9 Build 251226 Rel.55870n	1.1.9 Build 251226 Rel.55870n
tp-link_systems_inc	tapo_d235_v1	< 1.2.2 Build 260210 Rel.27165n	1.2.2 Build 260210 Rel.27165n
tp_link_systems_inc	tapo_c520ws_v2.6	< 1.2.4 Build 260326 Rel.24666n	1.2.4 Build 260326 Rel.24666n

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 6.9 MEDIUM CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22