CVE-2026-20018 — Path Traversal: 'dir/../../filename' in Cisco Secure Firewall Management Center

CWE-27 — Path Traversal: 'dir/../../filename'4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.2%
top 57.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Secure Firewall Management CenterCisco Secure Firewall Threat Defense Software
Timeline
PublishedMar 4

Description

A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This vulnerability is due to insufficient validation of the directory path during file synchronization. An attacker could exploit this vulnerability by crafting a directory path outside of the …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:HExploitability: 0.7 | Impact: 5.2

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-6jcc-w84h-p298: A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD)↗2026-03-04
▶
CVEList
Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability↗2026-03-04
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Path Traversal Vulnerability↗2026-03-04
▶
CVE-2026-20018 — Path Traversal: 'dir/../../filename' | cvebase