Introduction During one of our penetration tests of an industrial environment I came across Golem OEE MES — a Manufacturing Execution System developed by Neuron Soft. The system was accessible from the internal network on a non-standard port, with no authentication prompt on the main interface. That alone was worth a closer look. After a brief reconnaissance I noticed the application served static files directly via HTTP. I decided to check whether the file-serving mechanism properly restricted access to the application directory - it did not.
Affected versions All versions before 11.6.0.
Prerequisites • Network access to the LAN segment where Golem OEE MES is running (port 8181/tcp).
• No authentication required.
PoC Example #1 – Reading the win.ini File

The first thing I tried was a basic traversal payload targeting windows/win.ini:

Server response: Example #2 – Reading the hosts File Server response: Example #3 – Reading the NetSetup.log File Server response:
Path traversal vulnerabilities are nothing new, yet they continue to appear in production software, including industrial environments. In this case, a single malformed request was enough to read files from the server without requiring any credentials. References: https://cert.pl/en/posts/2026/06/CVE-2026-8464/