SOCFortress CoPilot CVE‑2026‑61738：允許 root 許可權寫入主機檔案（路徑穿越）
CVE-2026-61738 - SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
SOCFortress CoPilot 在 0.1.77 版之前的 POST /api/scoutsuite/generate-gcp-report 路由存在路徑穿越漏洞，攻擊者可以 root 許可權寫入任意主機檔案。
此漏洞允許攻擊者以 root 許可權覆寫主機檔案，可能導致服務中斷，提醒使用者盡速升級至 0.1.77 版並檢查檔案上傳處理。
譯文尚未完整，完整內容請切換至原文。
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.
影響
受影響產品
以下產品受到 CVE-2026-61738 漏洞影響。
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
尚未列出受影響產品
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| 分數 | 版本 | 嚴重度 | 向量 | 可利用性分數 | 影響分數 | 來源 |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | MITRE-CVE | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
請將軟體更新至 0.1.77 或更高版本以修正路徑遍歷漏洞。
- 請將應用程式更新至 0.1.77 或更高版本。
- 請驗證檔案上傳處理及路徑清理。
- 請檢查報告產生的目錄許可權。
以下列出精選的外部連結，提供關於 CVE-2026-61738 的深入資訊、實用解決方案與有價值的工具。
雖然 CVE 會識別漏洞的具體例項，CWE 則將可能導致漏洞的常見缺陷或弱點進行分類。 CVE-2026-61738 與以下 CWEs 相關聯：
Common Attack Pattern Enumeration and Classification (CAPEC) 儲存攻擊模式，這些模式描述了對手利用 CVE-2026-61738 弱點所採用的常見屬性與方法。
我們掃描 GitHub 倉庫以偵測新的概念驗證（PoC）攻擊。以下列表是已釋出於 GitHub 的公開攻擊與概念驗證集合（按最近更新時間排序）。
結果僅限於前 15 個倉庫，因為可能存在效能問題。
以下列表為文章中提及 CVE-2026-61738 漏洞的新聞。
以下表格列出了隨時間變化對 CVE-2026-61738 漏洞所做的更改。
漏洞歷史細節有助於瞭解漏洞的演變，並識別可能影響漏洞嚴重性、可利用性或其他特徵的最新變更。
-
New CVE Received By [email protected]
十月. 30, 2026
Action Type Old Value New Value Added Description SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 已新增 CWE CWE-22 已新增 CWE CWE-434 已新增 CWE CWE-73 已新增 Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/61xxx/CVE-2026-61738.json">CVE-2026-61738</a> 已新增 Reference https://github.com/socfortress/CoPilot/commit/1881ef8d28bc7f45ffa88d7ba4fcca7302355508 已新增 Reference https://github.com/socfortress/CoPilot/commit/bfa630b65d554670c7462a32ce6fd4e3cbd0254c 已新增 Reference https://github.com/socfortress/CoPilot/pull/940 已新增 Reference https://github.com/socfortress/CoPilot/pull/941 已新增 Reference https://github.com/socfortress/CoPilot/security/advisories/GHSA-q3g8-3cf7-744f 已新增 Reference https://github.com/socfortress/CoPilot/tree/v0.1.77
EPSS 是每日估算在未來 30 天內觀測到利用活動的機率。以下圖表顯示此漏洞的 EPSS 分數歷史。