CVE-2026-4415: gigabyte control_center Relative Path Traversal
CVSS: 9.8v3.1CriticalAnalyzed
Published 30-03-2026Last modified 31-03-2026
Vulnerability summary
CVE-2026-4415 is a critical (CVSS 9.8) Relative Path Traversal vulnerability in gigabyte control_center. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.5% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.94%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 30-03-2026PublishedVulnerability first disclosed.
- 31-03-2026Last modifiedVulnerability information updated.
Description
Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.
CVSS metrics
4 scores · 2 sources · 2 versionsCritical 9.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST9.2CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources2 sources · 8.1–9.8
- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.94%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
-0.05 pp
From 0.99% on 21-09-2026
21-09-202621-10-2026
EPSS score0.94%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Gigabyte2 products
- control_center< 25.12.10.01
- gigabyte control center≤ 25.07.21.01
1 vendor · 2 products
References
2 links- www.twcert.org.tw/tw/cp-132-10803-ae014-1.htmlThird Party Advisory
- www.twcert.org.tw/en/cp-139-10804-689cd-2.htmlThird Party Advisory