EUVD-2026-39154
GHSA-9723-5cpr-v9rm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Authenticated plugin user (PR:L) sends a crafted expression over the network (AV:N/AC:L); arbitrary write gives high integrity and low availability impact with no disclosure (C:N).
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.
AnalysisAI
Arbitrary file write in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated attacker supply a crafted expression parameter to write attacker-controlled content to any filesystem path the plugin process can reach. The flaw (CWE-22 path traversal) carries a CVSS 7.1 with high integrity impact and there is no public exploit identified at time of analysis, but it is dangerous because arbitrary writes can be leveraged toward code execution or configuration tampering within the SOAR plugin runtime.
Technical ContextAI
InsightConnect is Rapid7's SOAR (Security Orchestration, Automation and Response) platform, and the Sed Plugin is one of its automation connectors that exposes the Unix stream editor (sed) functionality to playbooks. The CPE cpe:2.3:a:rapid7:insightconnect_sed_plugin confirms the affected component is this specific plugin (all versions, per the wildcard) running on Linux. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the plugin uses the user-supplied 'expression' parameter to determine an output file path without adequately constraining traversal sequences, so input that escapes the intended working directory results in writes to arbitrary absolute paths within the plugin container/host's reach.
RemediationAI
Update the InsightConnect Sed Plugin to the latest version published on the Rapid7 extension marketplace (https://extensions.rapid7.com/extension/sed) and review the vendor advisory there for the specific patched plugin build; a precise fixed version is not stated in the available data, so confirm the corrected release directly with Rapid7. As compensating controls until patched: restrict which InsightConnect users and workflows are permitted to invoke the Sed plugin (limiting the PR:L attacker pool), and audit/whitelist the expression parameter values used in production playbooks so that untrusted or externally-influenced input cannot reach the plugin - the trade-off is reduced flexibility in dynamic playbooks. Where feasible, run the plugin container with a least-privilege filesystem (read-only mounts outside its required output directory) to blunt the impact of an arbitrary write, accepting that some legitimate file-writing automations may need explicit path exceptions.
More in Insightconnect Sed Plugin
View allOS command injection in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated operator inject arbitrary sh
Arbitrary file read in Rapid7's InsightConnect Sed Plugin on Linux exposes sensitive host filesystem contents to authent
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today