---
id: CVE-2026-0651
title: >-
  A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1,
  C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests
summary: >-
  A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1,
  C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The
  server performs path normalization before fully decoding URL encoded input and
  fa…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: tp-link
product: tapo_c260_firmware
affected:
  - tapo_c260_firmware < 1.1.9
patched:
  - tapo_c260_firmware 1.1.9
published: '2026-02-10'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0651'
references:
  - url: >-
      https://www.tp-link.com/en/support/download/tapo-c211/v2/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/download/tapo-c260/v1/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/download/tapo-c520ws/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/download/tapo-d235/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c211/v2/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/download/tapo-c260/v1/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/download/tapo-c520ws/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/4960/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - exploit-available
epss: 0.00318
epssPercentile: 0.24938
ingestedAt: '2026-08-05T11:47:23.679Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/l0lsec/tapo-c260-rce'
  checkedAt: '2026-09-24T07:52:56.231Z'
exploitAvailable: true
---

## Overview

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. 

Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.

## Affected

- `tapo_c260_firmware < 1.1.9`

## Remediation

Upgrade past the affected range:

- `tapo_c260_firmware 1.1.9`