Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected product may be retrieved by a logged-in user with the low("monitoring user") or higher privilege.

Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected product may be retrieved by a logged-in user with the low("monitoring user") or higher privilege.

Network Cameras TRIFORA 3 series provided by TOA Corporation contain multiple vulnerabilities listed below.<ul><li>OS command injection (CWE-78) - CVE-2026-20759</li><li>Cross-site scripting (CWE-79) - CVE-2026-20894</li><li>Path traversal (CWE-22) - CVE-2026-22876</li></ul>Shogo Iyota of GMO Cybersecurity by Ierae reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.