EUVD-2026-39155
GHSA-v6m6-hc9j-5r5w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via InsightConnect interface (AV:N), low-privilege authentication required to invoke the plugin (PR:L), confidentiality-only impact reading arbitrary files with no write or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
3DescriptionCVE.org
Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.
AnalysisAI
Arbitrary file read in Rapid7's InsightConnect Sed Plugin on Linux exposes sensitive host filesystem contents to authenticated attackers through an unsanitized expression parameter. All versions are affected per the CPE wildcard, and exploitation requires only a low-privilege authenticated InsightConnect session over the network with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-22 path traversal class is well-understood and mechanically straightforward to exploit once authentication is obtained.
Technical ContextAI
The InsightConnect Sed Plugin is an automation extension for Rapid7's SOAR platform that provides sed-style text manipulation within security workflows. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal: user-supplied input to the plugin's expression parameter is not sufficiently validated or sanitized before being used to reference filesystem paths on the Linux host. This allows sequences such as directory traversal markers to escape the intended working context and resolve to arbitrary paths. On Linux hosts, this can expose high-value files including /etc/shadow, SSH private keys, application credentials, or configuration files containing secrets. The CPE string cpe:2.3:a:rapid7:insightconnect_sed_plugin:*:*:*:*:*:*:*:* confirms no version bound - all releases are affected.
RemediationAI
Consult the Rapid7 vendor advisory at https://extensions.rapid7.com/extension/sed for the patched plugin version and upgrade instructions - no exact fixed version number was independently confirmed from the available data, so the advisory is the authoritative source. While awaiting a patch, apply the principle of least privilege within InsightConnect by restricting Sed Plugin access to only operationally necessary roles, reducing the pool of accounts that can invoke the vulnerable expression parameter. If sed-style text manipulation is not required in active workflows, disable or remove the Sed Plugin entirely - this eliminates the attack surface with the trade-off of losing that automation capability. Enable and review InsightConnect workflow audit logs to detect anomalous expression parameter values containing traversal sequences. Do not expose the InsightConnect platform directly to untrusted networks; enforce network-level access controls to limit who can authenticate to the platform.
More in Insightconnect Sed Plugin
View allOS command injection in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated operator inject arbitrary sh
Arbitrary file write in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated attacker supply a crafted ex
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today