Skip to main content

Eclipse SW360 CVE-2026-79653

| EUVDEUVD-2026-67130 MEDIUM
Path Traversal (CWE-22)
2026-08-27 eclipse
Path Traversal Eclipse Sw360
6.0
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

AC:H captures the non-default filesystem storage configuration prerequisite; S:C reflects that successful traversal writes outside the application boundary to the host OS filesystem.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 27, 2026 - 18:21 vuln.today
Analysis Generated
Aug 27, 2026 - 18:21 vuln.today
Patch available
Aug 27, 2026 - 18:02 EUVD

DescriptionCVE.org

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal.

The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.

AnalysisAI

Path traversal in Eclipse SW360's optional filesystem attachment store allows authenticated low-privilege users to write files to arbitrary paths on the host operating system by crafting malicious filenames during attachment upload. Affected versions span 19.0.0 through 20.1.0 exclusively when the non-default enable.attachment.store.to.file.system configuration key is active. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege SW360 account
Delivery
Enable or identify filesystem storage configuration
Exploit
Craft attachment filename with traversal sequence (e.g., ../../../../etc/cron.d/evil)
Execution
Submit multipart upload to SW360 attachment endpoint
Persist
Server writes attacker content to arbitrary OS filesystem path
Impact
Overwrite sensitive file to achieve privilege escalation or persistence
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two conditions must be simultaneously satisfied: (1) The SW360 instance must have the `enable.attachment.store.to.file.system` configuration key explicitly enabled - this is an opt-in, non-default setting; deployments using database-backed attachment storage (the default) are completely unaffected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L) accurately characterizes the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated SW360 user with attachment upload rights submits a multipart HTTP upload request with a crafted filename such as `../../../../etc/cron.d/malicious_job` targeting a deployment with `enable.attachment.store.to.file.system` enabled. The server resolves the filename against the attachment directory without sanitization and writes attacker-controlled file content to `/etc/cron.d/malicious_job`, enabling scheduled command execution as the OS user running SW360. …
Remediation Upgrade to Eclipse SW360 20.0.1 or 20.1.1, which incorporate the path traversal fix via GitHub PRs #4516 (https://github.com/eclipse-sw360/sw360/pull/4516), #4517, and #4518. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-79653 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy