{"id":"CVE-2026-92748","state":"PUBLISHED","title":"BC Security Empire before 6.7.1 Path Traversal File Upload RCE","description":"BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.","publishedAt":"2026-09-16T20:32:22.030Z","updatedAt":"2026-09-18T18:25:40.047Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["BC-SECURITY Empire"],"affected":[{"vendor":"BC-SECURITY","product":"Empire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.7.1","versionType":"semver"}]}],"references":["https://github.com/BC-SECURITY/Empire/issues/824","https://github.com/BC-SECURITY/Empire","https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_service.py#L148-L193","https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d4762a","https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1","https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traversal-file-upload-rce"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92748.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92748","state":"PUBLISHED","datePublished":"2026-09-16T20:32:22.030Z","dateUpdated":"2026-09-18T18:25:40.047Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-16T18:57:07.057Z"},"containers":{"cna":{"title":"BC Security Empire before 6.7.1 Path Traversal File Upload RCE","descriptions":[{"lang":"en","value":"BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution."}],"affected":[{"vendor":"BC-SECURITY","product":"Empire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.7.1","versionType":"semver"}]}],"references":[{"url":"https://github.com/BC-SECURITY/Empire/issues/824","tags":["issue-tracking"],"name":"GitHub Issue #824"},{"url":"https://github.com/BC-SECURITY/Empire","tags":["product"]},{"url":"https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_service.py#L148-L193","tags":["technical-description"],"name":"create_download builds the destination from the client-supplied multipart filename"},{"url":"https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d4762a","tags":["patch"],"name":"fix(api): block path traversal in file upload endpoints"},{"url":"https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1","tags":["release-notes"],"name":"Empire v6.7.1 Release Notes"},{"url":"https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traversal-file-upload-rce","name":"VulnCheck Advisory: BC Security Empire before 6.7.1 Path Traversal File Upload RCE","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-16T20:32:22.030Z"},"datePublic":"2026-06-21T00:00:00.000Z","credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/BC-SECURITY/Empire/issues/824","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-18T18:24:56.862853Z","id":"CVE-2026-92748","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-18T18:25:40.047Z"}}]}}}