Advisory · CVE-2026-80156
Lantern: Lantronix upload filename validation bypass enables arbitrary file write
A path traversal flaw in the web management upload endpoint of Lantronix out-of-band devices lets authenticated attackers write arbitrary files anywhere on the filesystem, leading to remote code execution. CVSS 9.1.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80156
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A mailroom checks envelopes for forbidden backslashes but forgets about forward slashes if both are present. Addressing a letter with both lets you slip it into any pigeonhole in the building.
- 01Authenticated upload
An attacker with device credentials reaches the web management portal upload endpoint.
- 02Filename crafted
They submit a filename containing both backslash and forward slash characters.
- 03Validation bypass
The filename check strips backslashes but then fails to check for forward slashes when a backslash was detected.
- 04Arbitrary write
The file lands outside the upload directory at any writable path, enabling remote code execution.
What happened
From the September 21, 2026 Lantern disclosure: the web management portal upload endpoint on Lantronix autonomous out-of-band devices validates upload filenames by stripping backslashes but does not subsequently check for forward slashes when a backslash is detected. An authenticated attacker supplying a filename with both characters can write arbitrary data to any filesystem location, leading to remote code execution. Affected: SLC8000 before firmware 9.7.0.5, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 9.1 (v3.1).
What to do
- Upgrade SLC8000 to firmware 9.7.0.5 or later and EMG8500/7500 to 9.7.0.1 or later.
- Restrict the web portal to the OOB network and audit recent uploads for suspicious filenames.
- Review filesystem integrity on managed appliances where upload endpoints were reachable.
Management note
Input validation that quits halfway is a classic, and on an OOB appliance it hands attackers the keys to reprogram the device. Patch alongside the rest of the Lantern cluster.