Scirius
Monthly
Authenticated attackers holding a default 'User' role account on Scirius 3.8.0 and earlier can write attacker-controlled JSON files to arbitrary filesystem paths through the PCAP filestore upload endpoint, which derives the destination filename from a user-supplied document _id field. Scored 7.2 both under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the flaw delivers high integrity and availability impact with no confidentiality loss, and because files are written with a forced .json extension the damage comes from poisoning JSON configuration data or consuming disk rather than planting executable code; if the Scirius service runs as root, writes can land in privileged locations. Exploitation requires network reachability to the upload endpoint plus a low-privileged authenticated account (no user interaction), and no public exploit code was identified at time of analysis, with no CISA KEV listing and no EPSS signal provided in the available data.
Authenticated attackers holding a default 'User' role account on Scirius 3.8.0 and earlier can write attacker-controlled JSON files to arbitrary filesystem paths through the PCAP filestore upload endpoint, which derives the destination filename from a user-supplied document _id field. Scored 7.2 both under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the flaw delivers high integrity and availability impact with no confidentiality loss, and because files are written with a forced .json extension the damage comes from poisoning JSON configuration data or consuming disk rather than planting executable code; if the Scirius service runs as root, writes can land in privileged locations. Exploitation requires network reachability to the upload endpoint plus a low-privileged authenticated account (no user interaction), and no public exploit code was identified at time of analysis, with no CISA KEV listing and no EPSS signal provided in the available data.