Path Traversal in Rockwell Automation Studio 5000 Logix Designer
CVE-2026-9108
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.001 (3.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Rockwell Automation Studio 5000 Logix Designer — versions V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older
- Rockwellautomation Studio_5000_logix_designer — versions 36.00
Weakness classification (CWE)
References
- PSIRT@rockwellautomation.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-9108?
- CVE-2026-9108 is a high-severity vulnerability in Rockwell Automation Studio 5000 Logix Designer, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-14.
- How severe is CVE-2026-9108?
- High severity. CVSS v3 base score is 7.5 out of 10.