Comfast CF-WR632AX: Multipart Parser path traversal (CVE-2026-122013)
A path traversal vulnerability exists in the Multipart Parser component of the Comfast CF-WR632AX (2.6.0.1) router.
CVE search metadata
CVE search record: CVE-2026-122013. Severity: critical. CVSS: 10.0. KEV: no. Product: CF-WR632AX (2.6.0.1). Brief: Comfast CF-WR632AX: Multipart Parser path traversal (CVE-2026-122013). Brief link: https://feed.craftedsignal.io/briefs/2026-11-path-traversal/
Triage facts
Revision 2- Applicability
- CF-WR632AX (2.6.0.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 5, 00:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
A vulnerability has been identified in the Comfast CF-WR632AX firmware version 2.6.0.1. The issue resides in the /usr/bin/webmgnt component's Multipart Parser. By manipulating the 'filename' argument, an attacker can perform path traversal. The attack can be initiated remotely. The exploit is public, and the vendor has not responded to disclosure efforts.