CVE-2026-92604
highScirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacke…
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/StamusNetworks/scirius disclosure@vulncheck.com
- https://github.com/StamusNetworks/scirius/blob/3bb49d383f4801b79e6356f9de9f25806afe0311/su... disclosure@vulncheck.com
- https://github.com/geo-chen/oss/blob/main/scirius.md disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/scirius-through-3.8.0-arbitrary-file-write-via-pcap-u... disclosure@vulncheck.com
- https://github.com/geo-chen/oss/blob/main/scirius.md 134c704f-9b21-4f2e-91b3-4a467353bcc0