{"cve":"CVE-2026-76652","nvd":{"published":"2026-09-10T21:17:44.683","modified":"2026-09-11T15:21:12.850","status":"Deferred","description":"An\nauthenticated directory traversal vulnerability in file upload functionality has\nbeen identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file\ninformation, an authenticated remote attacker with access to the affected\nupload functionality could upload a specially crafted file and cause it to be\nwritten outside the intended directory. \n\n\n\n\n\nSuccessful\nexploitation could allow an authenticated remote attacker to write files to\nunintended locations, potentially overwriting or modifying files\naccessible to the affected service; arbitrary code execution has not\nbeen demonstrated.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":4.8},"cvss_v3":null,"cwes":["CWE-22"],"references":["https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware","https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware","https://www.tp-link.com/us/support/faq/5292/"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:52:53.108888569+00:00"},"epss":{"cve":"CVE-2026-76652","score":0.00732,"percentile":0.5435,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}