CVE-2026-61738: SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as GCPScoutSuiteJSON, but passes raw file.filename from the multipart header to savefiletodirectory in backend/app/integrations/scoutsuite/services/scoutsuite.py. The writer combines this filename with scoutsuite-report using os.path.join without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOCFortress CoPilotto a version that resolves this vulnerability.Fixed in 0.1.77
Event History
Frequently Asked Questions
Which users can reach the affected upload functionality?
The affected route admits admin and analyst users. Exploitation requires supplying a crafted multipart filename while uploading content accepted as GCPScoutSuiteJSON.
Which versions require remediation?
Versions prior to 0.1.77 are affected. Version 0.1.77 removes caller-controlled filenames from the affected route.
What is the practical impact in a root-running deployment?
A traversal filename can cause accepted JSON content to be written outside the intended scoutsuite-report directory. In the reported root-running backend, this enabled root-owned writes including into the application source directory and could disrupt application operation; the demonstrated primitive did not establish unrestricted executable content writes.