F´ (F Prime) CVE-2026-92153

Exploitation requires that the attacker can transmit Fw::FilePacket::StartPacket packets to the Svc::FileUplink component - i.e. access as a peer authorized on the file-uplink/command channel (reflected as PR:L). The specific flaw is that FileUplink uses the packet-supplied destinationPath verbatim, so the attacker must supply an absolute, traversing ('../'), or otherwise writable path, and the chosen location must be writable by the flight/embedded process. This is the default behavior prior to 4.3.0 - no special non-default feature toggle is needed once uplink access exists; the primary limiting factor is obtaining that uplink/command-channel access, and impact is bounded to filesystem locations writable by the process (no confidentiality disclosure).

This is a genuine integrity-focused risk for F´ operators, but one gated by access to the file-uplink channel rather than a wide-open remote hole. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:N/I:H/A:L, 7.1 High) is internally consistent with the description: exploitation requires 'a peer able to send file-uplink packets' (PR:L - an authenticated/authorized peer on the uplink interface), after which low-complexity, no-interaction packet crafting yields arbitrary file write (I:H) and potential availability loss (A:L), with no confidentiality exposure (C:N). SSVC-style reading: technical impact is partial-to-total for integrity, but exploitation is NOT automatable in the usual sense because the attacker must already hold command/uplink access to a flight or embedded system. Signals that are MISSING: no EPSS probability was provided, there is no CISA KEV listing, and no public exploit code was supplied - the only 'source code evidence' is the vendor's own fix (PR #5320 / commit 4c8b9c0), which is a patch, not a weaponized POC. Net: a real priority for anyone running F´ below 4.3.0 with an exposed or shared uplink path, but not an internet-wide mass-exploitation candidate; the PR:L prerequisite meaningfully narrows the realistic attacker set.

An attacker who can place packets on the F´ file-uplink channel - for example a compromised or rogue ground/peer node authorized to send commands - crafts an Fw::FilePacket::StartPacket whose destinationPath is an absolute or '..'-traversing path pointing outside the intended upload directory. Because Svc::FileUplink copies the packet-controlled path and opens it for writing without canonicalization or sandbox confinement, the attacker creates or overwrites files at chosen writable filesystem locations, corrupting configuration or data and potentially degrading availability. No public exploit is identified; only the vendor fix (PR #5320) is available.