CVE-2026-92748

Name of the Vulnerable Software and Affected Versions BC Security Empire versions prior to 6.7.1

Description Authenticated operators can write files to arbitrary paths on the C2 server because the software fails to validate the multipart filename parameter in upload endpoints. By using path traversal sequences—a technique used to access files and directories outside the intended folder—in the filename, attackers can bypass directory containment and write malicious files to sensitive locations to achieve code execution.

Recommendations Update BC Security Empire to version 6.7.1 or later.