CVE-2026-78312: DIAEnergie Path Traversal Enables Unauthenticated File System Access

Executive Summary

CVE-2026-78312 is a critical path traversal vulnerability (CWE-22) in Delta Electronics' DIAEnergie, an industrial and building energy-management platform used to monitor and report on power consumption across commercial and industrial sites. The flaw stems from improper neutralization of path-traversal sequences: DIAEnergie versions before 1.11.00.022 fail to adequately validate or canonicalize user-supplied path input before using it in a file system operation, allowing an attacker to escape the directory the application intended to restrict access to.

The vulnerability was reserved on August 24, 2026 and published on September 24, 2026, assigned by Delta Electronics (Deltaww) itself. It carries a CVSS 3.1 score of 9.1 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H — remotely exploitable over the network, low attack complexity, no privileges and no user interaction required. Notably, the published vector scores no direct confidentiality impact (C:N) but high integrity and availability impact (I:H/A:H), indicating the primary risk is unauthorized file write/overwrite outside the intended directory rather than straightforward file disclosure.

Delta's vendor advisory, Delta-PCSA-2026-00014, discloses CVE-2026-78312 together with several other DIAEnergie flaws found in the same review, including a separate, more severe authentication bypass tracked as CVE-2026-78308 (CVSS 9.8) and multiple SQL injection issues. CVE-2026-78312 is a distinct vulnerability from CVE-2026-78308 — they share a disclosure batch and an affected-version range, not a root cause — though an attacker could plausibly chain them. No public proof-of-concept or confirmed in-the-wild exploitation has been reported for CVE-2026-78312 as of publication. As of this writing, no dedicated CISA ICS-CERT advisory specific to this CVE has been located; the vendor advisory is the primary authoritative source.

Vulnerability Overview

Field	Value
CVE ID	CVE-2026-78312
CVSS 3.1 Score	9.1 (Critical) — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`
Type	Path Traversal (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)
Product	Delta Electronics DIAEnergie (industrial/building energy-management software)
Attack Vector	Network
Privileges Required	None
User Interaction	None
Assigner	Deltaww (Delta Electronics)
Reserved	August 24, 2026
Published	September 24, 2026
Vendor Advisory	Delta-PCSA-2026-00014

Affected Versions

Component	Affected Version	Fixed Version
DIAEnergie	Before 1.11.00.022	1.11.00.022 (or later)

Delta Electronics has confirmed 1.11.00.022 as the patched release. Organizations running any DIAEnergie build prior to that version should treat this vulnerability as applicable and prioritize the upgrade.

Attack Vector

Delta's advisory and the public trackers that have analyzed it have not disclosed the specific vulnerable endpoint, parameter, or a working proof-of-concept for CVE-2026-78312. The walkthrough below reflects the general path-traversal mechanics confirmed by the CWE-22 classification and the published CVSS vector — treat any third-party writeup that claims a concrete request or payload as unverified until Delta or CISA confirms it.

1. Attacker identifies a DIAEnergie deployment (energy-management web
   application) reachable over the network, running a version prior
   to 1.11.00.022.
 
2. Attacker sends a request to a DIAEnergie endpoint that accepts a
   file path, filename, or similar path-shaped parameter, embedding
   directory traversal sequences ("../" or "..\") in the value.
 
3. DIAEnergie does not adequately validate or canonicalize the
   supplied path before using it in a file system operation
   (CWE-22), so the traversal sequences are honored rather than
   stripped or rejected.
 
4. The resulting file system access resolves outside the directory
   the application intended to restrict the operation to.
 
5. Per the published CVSS vector (C:N/I:H/A:H), the dominant
   consequence is unauthorized WRITE access -- creating or
   overwriting files outside the intended directory -- rather than a
   direct confidentiality loss. Depending on which files can be
   reached, this could corrupt application data, plant a malicious
   file, or destabilize the host.
 
6. No authentication is required to reach the vulnerable code path
   (AV:N/PR:N/UI:N), and no public proof-of-concept or confirmed
   in-the-wild exploitation has been reported as of publication.

Impact Assessment

Impact Area	Description
Integrity	The CVSS vector reports high integrity impact (I:H) — an attacker can create or overwrite files outside the directory DIAEnergie intended to restrict access to
Availability	High availability impact (A:H) — overwriting application or system files reachable via the traversal could crash or destabilize DIAEnergie or its host
Confidentiality	The published vector reports no direct confidentiality impact for this specific CVE (C:N); however, chained exploitation with other flaws in the same disclosure batch could still expose data
Compound risk	Disclosed alongside CVE-2026-78308 (unauthenticated authentication bypass, CVSS 9.8) and multiple SQL injection flaws in the same advisory (Delta-PCSA-2026-00014) — an attacker able to reach one DIAEnergie flaw may be positioned to chain others
OT/ICS exposure	DIAEnergie is deployed for industrial and building energy monitoring; a compromised instance on an OT-adjacent or facilities network could affect energy-management visibility or control workflows

Immediate Remediation

Patch first

Upgrade DIAEnergie to version 1.11.00.022 or later immediately. This is the vendor-confirmed fix and the only complete remediation.

If immediate patching isn't possible

Restrict network access to the DIAEnergie web interface to trusted administrative hosts only — do not expose it directly to the internet.
Deploy WAF rules to detect and block path-traversal sequences (../, ..\, URL-encoded variants) in requests to DIAEnergie.
Run the DIAEnergie service with least privilege so that any file write reachable via the traversal is confined to the smallest possible blast radius.
Segment DIAEnergie deployments onto an isolated VLAN, away from other OT/ICS systems and sensitive hosts, until patched.

Address the batch, not just this CVE

Because CVE-2026-78312 was disclosed alongside CVE-2026-78308 (authentication bypass) and multiple SQL injection issues in the same DIAEnergie release range, upgrading to 1.11.00.022 should be treated as closing the entire Delta-PCSA-2026-00014 batch, not just this single finding.

Detection Indicators

Indicator	Notes
Requests containing `../` or `..\` sequences (including URL-encoded forms) in DIAEnergie web/access logs	Primary signature of path-traversal probing
Unexpected files created or modified outside DIAEnergie's expected application directories	Consistent with the I:H write-primitive nature of this flaw
Unplanned DIAEnergie service crashes or restarts	May indicate exploitation attempts causing availability impact (A:H)
DIAEnergie instances still reporting a version prior to 1.11.00.022	Treat as vulnerable and unpatched until confirmed upgraded
Inbound traffic to DIAEnergie from unfamiliar or external source IPs	Especially where DIAEnergie is expected to be reachable only from an internal or OT-adjacent network

Post-Remediation Steps

Confirm every DIAEnergie instance in your environment has been upgraded to 1.11.00.022 or later and verify the running version directly, not just the deployment manifest.
Audit the file system on DIAEnergie hosts for unauthorized file creation or modification predating the patch.
Review Delta's advisory Delta-PCSA-2026-00014 for the full set of disclosed flaws (including CVE-2026-78308 and the accompanying SQL injection issues) and confirm the same upgrade addresses all of them.
Re-restrict network exposure for DIAEnergie to only what's operationally required, even after patching.
Continue monitoring NVD, Delta's security advisory channel, and CISA ICS-CERT for any follow-up guidance or a dedicated ICS advisory for this CVE.