| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0046 | High | August 11, 2026 | External submission | CNNVD-2026-79982062 |
Overview
The resumable file upload interface in Hillstone HSA does not validate file names for path traversal. An attacker can upload a malicious script file to the web root directory via path traversal. This interface does not require authentication, which can lead to remote code execution.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| HSA | HSA 2.22.7 and earlier versions | HSA 2.22.8 |
Remediation & Mitigation
- Upgrade to HSA 2.22.8 or later versions to fix this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments