A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Tp-link
  • Tapo C260
  • Tapo C260 Firmware
  • Tapo C260 V1

Configuration 1 [-]

AND
cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.tp-link.com/en/support/download/tapo-c260/v1/ cve-icon cve-icon
https://www.tp-link.com/en/support/download/tapo-c520ws/ cve-icon cve-icon
https://www.tp-link.com/en/support/download/tapo-d235/ cve-icon cve-icon
https://www.tp-link.com/us/support/download/tapo-c260/v1/ cve-icon cve-icon
https://www.tp-link.com/us/support/download/tapo-c520ws/ cve-icon cve-icon
https://www.tp-link.com/us/support/faq/4960/ cve-icon cve-icon
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description On TP-Link Tapo C260 v1 and D235 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities. A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N'}

 cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}

Fri, 13 Mar 2026 18:45:00 +0000

Type Values Removed Values Added
Description On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities. On TP-Link Tapo C260 v1 and D235 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.
References

Fri, 13 Feb 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link tapo C260
Tp-link tapo C260 Firmware
CPEs cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tp-link tapo C260
Tp-link tapo C260 Firmware
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 11 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link tapo C260 V1
Vendors & Products Tp-link
Tp-link tapo C260 V1

Wed, 11 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 17:45:00 +0000

Type Values Removed Values Added
Description On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.
Title Path Traversal on TP-Link Tapo D235 and C260 via Local https
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-02-10T17:27:51.942Z

Updated: 2026-04-02T17:26:18.757Z

Reserved: 2026-01-06T18:19:00.313Z

Link: CVE-2026-0651

cve-icon Vulnrichment

Updated: 2026-02-11T15:11:22.192Z

cve-icon NVD

Status : Modified

Published: 2026-02-10T18:16:21.977

Modified: 2026-04-02T18:16:26.293

Link: CVE-2026-0651

cve-icon Redhat

No data.