CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
Attackers can write or overwrite arbitrary files via path traversal in F Prime's FileUplink service, compromising system integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92153?
CVE-2026-92153 is a high-severity path traversal vulnerability in nasa fprime, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.
Which versions are affected by CVE-2026-92153?
How do I fix CVE-2026-92153?
No fix has been published for CVE-2026-92153 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-92153 being exploited?
There is no known exploitation of CVE-2026-92153 in the wild and no public exploit code.
Sources
Also known as GHSA-5rfj-hw2g-vwmv.