CVE-2026-79653: Path Traversal
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal.
The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Eclipse SW360, if using file system storage, disable file system attachment storage by setting enable.attachment.store.to.file.system to false.
Eclipse SW360 enable.attachment.store.to.file.system = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Eclipse SW360 19.0.0, 19.1.0, 19.2.0, 20.0.0, or 20.1.0 are affected when file system attachment storage is enabled through the enable.attachment.store.to.file.system configuration key.
What does an attacker need to do to exploit this issue?
The attacker needs to upload an attachment and manipulate its filename. This can be used to cause arbitrary file path traversal when file system storage is enabled.
What can be done if an update cannot be applied immediately?
Disable the enable.attachment.store.to.file.system configuration setting to stop using file system attachment storage. The stated alternatives are disabling this setting or updating to fixed versions.