CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory

High 7.5 Published 13 Feb 2026 Updated 13 Feb 2026

Attackers can write files to arbitrary directories due to lack of path validation in the BACnet Stack library, potentially compromising embedded systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21878?

CVE-2026-21878 is a high-severity path traversal vulnerability in bacnet-stack, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3.

Weakness: CWE-22

Which versions are affected by CVE-2026-21878?

It affects 1 product.

Products include Bacnetstack Bacnet Stack.

How do I fix CVE-2026-21878?

No fix has been published for CVE-2026-21878 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-21878 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21878 exists.

Sources

Also known as GHSA-p8rx-c26w-545j.