The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-61738: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-61738
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
SOCFortress CoPilot versions before 0.1.77 contain a path traversal flaw in POST /api/scoutsuite/generate-gcp-report, reachable by admin and analyst users. The route passes the raw multipart file.filename to save_file_to_directory, which joins it with scoutsuite-report without sanitization or a containment check. A traversal filename writes the uploaded JSON outside the intended directory, which allowed a researcher to write root-owned files into the application source directory. The primitive permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt operation, but it does not establish unrestricted executable content.
Mitigation
Fixed in 0.1.77, which removes caller-controlled filenames from the affected route.