Empire
Monthly
BC Security Empire before 6.7.1 is affected by an authenticated path traversal vulnerability in its multipart file upload flow; an operator with a valid Empire session can place a traversal sequence in the uploaded filename and write files outside the intended downloads directory on the C2 server, potentially achieving code execution. The issue is fixed in 6.7.1, which validates filenames and resolves upload paths safely; no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.7 (assessed CVSS 3.1 8.8) with high confidentiality, integrity, and availability impact. Exploitation requires network access to the C2 REST API and valid credentials or a hijacked operator session, so patched or access-restricted deployments are not exposed.
BC Security Empire before 6.7.1 is affected by an authenticated path traversal vulnerability in its multipart file upload flow; an operator with a valid Empire session can place a traversal sequence in the uploaded filename and write files outside the intended downloads directory on the C2 server, potentially achieving code execution. The issue is fixed in 6.7.1, which validates filenames and resolves upload paths safely; no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.7 (assessed CVSS 3.1 8.8) with high confidentiality, integrity, and availability impact. Exploitation requires network access to the C2 REST API and valid credentials or a hijacked operator session, so patched or access-restricted deployments are not exposed.