EUVD-2026-39162
GHSA-x3f7-qmw7-g6pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to InsightConnect with high-privilege account
-
DeliveryCraft archive filename with path traversal sequences
-
ExploitInvoke create_archive via workflow or API
-
ExecutionPlugin writes archive entry to traversed filesystem path
-
ImpactTarget file corrupted or overwritten on Linux host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid InsightConnect account with high-level privileges sufficient to create or trigger automation workflows (PR:H per CVSS vector); (2) access to a workflow or direct API call that invokes the Compression Plugin's create_archive function with attacker-controlled filename input; (3) the target system running Linux (the vulnerability is explicitly scoped to Linux). The attacker cannot control the content written to the traversed path, limiting impact to file corruption. High attack complexity (AC:H) indicates that exploitation is not straightforward and may require specific workflow configuration or timing. Mitigating factors: requires authenticated high-privilege access, Linux-only, no content control, no unauthenticated or low-privilege exploitation path. |
| Impact | Real-world risk is low. The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) scores 3.3, which accurately reflects the compounding constraints: high privileges required (PR:H), high attack complexity (AC:H), and impact limited to partial integrity and availability degradation with zero confidentiality loss. No EPSS score was provided in the input data. CISA KEV status is absent, indicating no confirmed active exploitation. No POC is identified. The most significant real-world risk is file corruption leading to availability disruption - for example, overwriting configuration files on the InsightConnect host - but the inability to control file content dramatically curtails weaponization. This is not a prioritization candidate for most organizations; patch during normal maintenance windows. |
| Exploit ScenarioDerived | An authenticated InsightConnect operator with high-privilege workflow permissions constructs a workflow that calls the Compression Plugin's create_archive function with a crafted filename containing path traversal sequences (e.g., '../../etc/cron.d/job'). Upon archive creation, the plugin writes the archive entry to the traversed path on the Linux host filesystem, corrupting or replacing an existing file. Because the attacker cannot control file content, the practical outcome is denial of service via file corruption rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Path traversal in Rapid7 InsightConnect's Compression Plugin on Linux allows authenticated attackers with high privileges to write files to arbitrary paths on the underlying host via crafted archive filenames passed to the create_archive function. Impact is constrained to file corruption - the attacker can control write destination but not write content, preventing code execution via this vector alone. No public exploit code exists and no KEV listing is present; the low CVSS score of 3.3 reflects the high authentication bar and limited impact scope.
RemediationAI
The primary remediation is to upgrade to a patched version of the Rapid7 InsightConnect Compression Plugin per the vendor advisory at https://extensions.rapid7.com/extension/compression. No specific patched version number was included in the available data - consult the advisory directly to confirm the fixed release. As a compensating control where upgrade is not immediately possible, restrict which InsightConnect users and roles have permission to invoke compression workflow steps, since exploitation requires high-privilege authenticated access. Additionally, audit and restrict write permissions of the InsightConnect service account on the Linux host to limit the blast radius of any path traversal attempt. Note that these controls reduce exposure but do not eliminate the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Rapid7 InsightConnect Compression Plugin, identified by CPE cpe:2.3:a:rapid7:insightconnect_compression_plugin:*:*:*:*:*:*:*:*, running on Linux. InsightConnect is Rapid7's SOAR (Security Orchestration, Automation, and Response) platform; the Compression Plugin provides archive creation/extraction capabilities within automation workflows. CWE-22 (Path Traversal) describes the root cause: the create_archive function fails to sanitize or canonicalize filenames before constructing archive entries, allowing sequences such as '../../../etc/cron.d/malicious' to escape the intended archive root and place file entries at arbitrary filesystem paths upon extraction. This is a classic Zip Slip-style pattern where archive creation does not validate member paths against an allowed base directory.
Know when Insightconnect Compression Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:H confirmed by authenticated-attacker requirement; AC:H for crafted-input constraint; no confidentiality loss per description; I:L and A:L for file corruption only.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB