CVE-2026-92604 Scirius through 3.8.0 Arbitrary File Write via PCAP Upload
Attackers with default user access can exploit path traversal in PCAP uploads to write arbitrary JSON files as root, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92604?
CVE-2026-92604 is a high-severity path traversal vulnerability in StamusNetworks scirius, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
Weakness: CWE-22
Which versions are affected by CVE-2026-92604?
How do I fix CVE-2026-92604?
No fix has been published for CVE-2026-92604 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-92604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92604 exists.
Sources
Also known as GHSA-h754-2546-79g9.