CVE-2026-92748
BC Security Empire before 6.7.1 Path Traversal File Upload RCE
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 16, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 16, 2026
Description
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
EmpireBC-SECURITY |
|
References
- GitHub Issue #824issue-tracking
- https://github.com/BC-SECURITY/Empireproduct
- create_download builds the destination from the client-supplied multipart filenametechnical-description
- fix(api): block path traversal in file upload endpointspatch
- Empire v6.7.1 Release Notesrelease-notes
- VulnCheck Advisory: BC Security Empire before 6.7.1 Path Traversal File Upload RCEthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.