SOCFortress CoPilot EUVD-2026-114001

Exploitation requires (1) a valid analyst- or admin-scoped bearer token, since the route is guarded by require_any_scope('admin','analyst') - it is NOT reachable unauthenticated despite the CVSS PR:N; (2) an uploaded body that passes GCPScoutSuiteJSON content validation (a syntactically valid GCP service-account JSON, trivial to supply); (3) a path-traversal payload placed in the multipart Content-Disposition filename, which Starlette does not sanitize; and (4) the backend running as root to write anywhere on the host - the default published ghcr.io image runs as root, maximizing impact. Affected versions are prior to 0.1.77. Limiting factors that reduce real-world risk below the raw 10.0: authentication is mandatory (analyst or admin), the uploaded content must validate as GCP JSON, and the arbitrary-write-to-RCE step depends on writing to an exploitable host path (cron directory, loaded Python module, startup script). Deployments that run the backend as a non-root user confine the write and prevent host-wide compromise.

This is a genuine act_now priority, not a high-CVSS-but-low-risk artifact: the GHSA advisory documents a concrete, confirmed-live arbitrary file write as root via unsanitized multipart filename in POST /api/scoutsuite/generate-gcp-report, trivially escalatable to RCE and full cross-tenant/connector-credential compromise. However, the signals conflict on one key point and must be stated plainly: the supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (unauthenticated), but the advisory and source show the route is guarded by require_any_scope('admin','analyst'), meaning a valid analyst- or admin-scoped token is actually required - so real-world exploitation is authenticated, and PR:N overstates reach; treat the practical privilege requirement as PR:L. The S:C/C:H/I:H/A:H and 10.0 score are justified by the root-level host write escaping the application sandbox. No EPSS score was provided (cannot gauge statistical exploitation probability), and the CVE is not indicated as present in CISA KEV, so there is no evidence of active in-the-wild exploitation despite the high severity. The mitigating factor - required admin/analyst authentication and a valid GCPScoutSuiteJSON body - narrows the threat to insiders or attackers who have already obtained operator credentials, but given that an analyst role (which should not have host access) suffices, and a working PoC is public, patching to 0.1.77 should be treated as urgent.

An attacker holding a valid analyst or admin bearer token (an insider, or an operator whose token was phished/leaked) uploads a syntactically valid GCP service-account JSON to the GCP report endpoint while setting the multipart Content-Disposition filename to a path-traversal string such as ../../../../etc/cron.d/x. Because the backend runs as root and joins the raw filename without sanitization or a containment check, the content is written anywhere on the host, letting the attacker drop a cron job or overwrite an application Python module to achieve code execution. A public PoC with working curl commands, confirmed live by the researcher against the published ghcr.io image, is included in the GHSA advisory.