CVE-2026-78299: Path Traversal
Published Sep 14, 2026
·Updated
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.
Affected Software
1 affected component
Eclipse Eclipse Embedded CDT>=6.0<=6.7
Event History
Sep 14, 2026
CVE Published
via MITRE·12:59 PM
Data Sourced
via MITRE·12:59 PM
DescriptionWeakness
Frequently Asked Questions
1
What must an attacker control to exploit this issue?
The attacker needs to provide or cause extraction of a compromised CMSIS-Pack archive. The malicious archive must contain paths that escape the intended pack extraction location.
2
Which installations are affected?
Eclipse Embedded CDT versions 6.0 through 6.7 are affected when they extract a compromised CMSIS pack.
3
What is the practical impact of successful exploitation?
A malicious CMSIS-Pack archive can write arbitrary files to locations outside the pack directory on disk. The specific impact depends on the permissions of the user or process performing the extraction.