Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SOCFortress CoPilot can let admins overwrite files as root

CVE-2026-61738 · published 5 days ago
Summary

Versions of SOCFortress CoPilot before 0.1.77 let admin and analyst users upload a ScoutSuite report using a file name they control. By choosing a specially crafted name, they can cause the program to write files outside the intended folder, potentially overwriting important files and disrupting the application. Updating to version 0.1.77 (or later) removes the ability to control the file name and resolves the issue; meanwhile, limit upload permissions and monitor file changes.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
socfortress copilot < 0.1.77
Original advisory text
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-73External Control of File Name or Path
CWE-434Unrestricted File Upload
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Sources
CVE-2026-61738 · NVD
CVE-2026-61738 · MITRE
CVE-2026-61738 · OSV
GHSA-q3g8-3cf7-744f · GHSA
Track software like this
Free during beta