EUVD-2026-52507
GHSA-7ffm-43mr-4fg5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network command interface, no authentication barrier per description, confidentiality-only impact with no write or availability effect confirmed.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
AnalysisAI
Path traversal in the DS_SetDestPathCmd() function of NASA Core Flight System (cFS) v7.0.1 enables remote unauthenticated attackers to bypass access controls and read sensitive system components by supplying a crafted destination path string. The DS (Data Storage) application fails to properly sanitize or restrict path values passed via command, violating the intended access control boundary between storage destinations and protected system components. A proof-of-concept exists per SSVC data, and exploitation is assessed as automatable, though real-world risk is tempered by the specialized aerospace deployment context and a very low EPSS score of 0.14% (4th percentile).
Technical ContextAI
NASA cFS (Core Flight System) is a reusable open-source flight software framework used in spacecraft and aerospace embedded systems. The DS (Data Storage) application within cFS is responsible for managing telemetry and event data storage to files, and exposes a command interface including DS_SetDestPathCmd(), which sets the file destination path for a data storage channel. CWE-284 (Improper Access Control) is the root cause classification, meaning the framework fails to enforce appropriate boundaries on what filesystem paths are permissible targets. The path traversal (using sequences such as '../') allows a command sender to redirect file operations outside the intended storage directories, potentially into sensitive areas of the flight software filesystem. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-specific and not usable for automated matching - affected product identification relies solely on the GitHub issue reference and version tag v7.0.1.
RemediationAI
No vendor-released patch with an exact fix version has been identified at time of analysis - the primary public reference is a GitHub issue report at https://github.com/nasa/cFS/issues/1072 rather than a tagged release or formal security advisory. Organizations using cFS v7.0.1 should monitor that issue for an upstream patch. As compensating controls, operators should restrict access to the cFS command interface to authorized ground systems only, enforcing authentication and encryption at the command uplink or telecommand layer to ensure only credentialed operators can issue DS_SetDestPathCmd() commands - this directly counteracts the PR:N condition in the CVSS vector. Additionally, configure ground system command filters or software command validation layers to reject DS destination path values containing traversal sequences ('..', absolute paths outside designated storage directories). Note that command-layer filtering may reduce operational flexibility in emergency scenarios and must be tested against nominal mission operations. A formal advisory from NASA has not been identified; track the vuldb entry at https://vuldb.com/vuln/385702 for updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today