{"cve":"CVE-2026-0651","nvd":{"published":"2026-02-10T18:16:21.977","modified":"2026-08-04T18:16:42.777","status":"Modified","description":"A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. \n\nSuccessful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-22"],"references":["https://www.tp-link.com/en/support/download/tapo-c211/v2/#Firmware-Release-Notes","https://www.tp-link.com/en/support/download/tapo-c260/v1/","https://www.tp-link.com/en/support/download/tapo-c520ws/","https://www.tp-link.com/en/support/download/tapo-d235/","https://www.tp-link.com/us/support/download/tapo-c211/v2/#Firmware-Release-Notes"],"products":["tp-link:tapo_c260_firmware"],"source":"nvd","synced_at":"2026-10-19T22:22:27.261130201+00:00"},"epss":{"cve":"CVE-2026-0651","score":0.00315,"percentile":0.24454,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}