PT-2026-85043 · Eclipse · Aerios Self-Orchestrator
CVE-2026-85199
·
Published
2026-09-03
·
Updated
2026-09-03
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1
Description
A path traversal issue exists in the REST API where user-controlled identifiers used for creating, updating, or deleting resources are incorporated into filesystem paths without proper validation or sanitization. This allows an unauthenticated remote attacker to use specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, depending on the filesystem permissions of the process. The risk is amplified by the lack of authentication on the API and deployment configurations where the container runs with elevated privileges.
Recommendations
Update to version 1.2.1.
Fix
Relative Path Traversal
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Aerios Self-Orchestrator