EUVD-2026-80897
GHSA-h754-2546-79g9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint reachable with a low-priv authenticated account (PR:L, AV:N, AC:L); arbitrary root-owned file write yields I:H and A:H with no read primitive (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
AnalysisAI
Authenticated attackers holding a default 'User' role account on Scirius 3.8.0 and earlier can write attacker-controlled JSON files to arbitrary filesystem paths through the PCAP filestore upload endpoint, which derives the destination filename from a user-supplied document _id field. Scored 7.2 both under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the flaw delivers high integrity and availability impact with no confidentiality loss, and because files are written with a forced .json extension the damage comes from poisoning JSON configuration data or consuming disk rather than planting executable code; if the Scirius service runs as root, writes can land in privileged locations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with the default 'User' role on a Scirius instance at version 3.8.0 or earlier (PR:L), and network access to the PCAP filestore upload endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) captures a network-reachable, low-complexity flaw requiring only a default 'User' role account, with high integrity and availability impact and no confidentiality loss - consistent with an arbitrary file write (attacker writes but cannot read). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so priority should go to compensating controls until an upgrade past 3.8.0 is published and verified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Scirius instance and confirm which are running 3.8.0 or earlier, restrict network access to the PCAP filestore upload endpoint so only trusted management networks and known administrative hosts can reach it, audit all accounts holding the default 'User' role and disable or re-scope any that are not strictly required, and verify whether the Scirius service account runs as root and reduce it to a dedicated non-privileged account where operationally possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today