Skip to main content

Eclipse aeriOS Self-orchestrator CVE-2026-85199

| EUVDEUVD-2026-70479 HIGH
Path Traversal (CWE-22)
2026-09-03 eclipse GHSA-vg3m-qwjp-6wvx
Path Traversal Eclipse Aerios Eclipse Foundation
8.8
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Unauthenticated network API with no interaction required; write and delete capability yields I:H and A:H, but no file read exposure means C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Sep 03, 2026 - 15:01 vuln.today
Analysis Generated
Sep 03, 2026 - 15:01 vuln.today
CVE Published
Sep 03, 2026 - 14:11 cve.org
HIGH 8.8

DescriptionCVE.org

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process.

The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration.

The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.

AnalysisAI

Path traversal in Eclipse aeriOS Self-orchestrator prior to version 1.2.1 allows unauthenticated remote attackers to write or delete arbitrary JSON files on the host filesystem by embedding path separator sequences (e.g., '../') in resource identifiers submitted to the REST API. The vulnerability stems from direct string concatenation of user-supplied names into fs.writeFileSync() paths without sanitization, confirmed by the upstream commit diff. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Network access to the Eclipse aeriOS Self-orchestrator REST API is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-accessible, unauthenticated, zero-complexity attack - consistent with SSVC's 'Automatable: yes' determination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Eclipse aeriOS Self-orchestrator to version 1.2.1, confirmed as the patched release by the upstream commit at https://github.com/eclipse-aerios/self-orchestrator/commit/c42da0014069528d149ff9f8b038ac93c38a766c, which updates the Docker image tag to eclipseaerios/self-orchestrator:1.2.1 and the Helm chart appVersion to 1.2.1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems running Eclipse aeriOS Self-orchestrator versions below 1.2.1 and document network exposure; immediately restrict REST API access using firewall rules to trusted networks only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Aerios

View all
CVE-2026-82955 CRITICAL
9.0 Sep 02

Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to
CVE-2026-84736 HIGH
8.3 Sep 03

TLS certificate validation is disabled by default in the Federator component of Eclipse aeriOS, enabling man-in-the-midd

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-85199 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy