CVE-2026-61738

10 CRITICALpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI risk analysis

Summary: A path traversal vulnerability in SOCFortress CoPilot's GCP report generation endpoint allows authenticated admin/analyst users to write arbitrary files outside the intended report directory by supplying a malicious filename in a multipart upload, potentially overwriting host files and disrupting application operation.
Exploitability: Exploitation requires valid admin or analyst credentials and knowledge of the vulnerable endpoint, but no additional privileges or user interaction.
Blast radius: Successful exploitation could lead to denial of service via source overwrite, but not arbitrary code execution or cross-tenant data theft under the described conditions.
Detection: Monitor for POST requests to /api/scoutsuite/generate-gcp-report containing multipart file uploads with filenames containing '..' or absolute paths; inspect backend logs for unexpected file writes outside the scoutsuite-report directory.
Prioritized remediation: Upgrade to SOCFortress CoPilot version 0.1.77 or later, which removes caller-controlled filenames from the affected route.

path-traversalfile-writeauth-bypasswebadmin-panel

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-22, CWE-73, CWE-434

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.