CVE-2026-85199: Path Traversal
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process.
The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration.
The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse aeriOS Self-orchestratorto a version that resolves this vulnerability.Fixed in 1.2.1 - Compensating control
Ensure the container running Eclipse aeriOS Self-orchestrator is not configured to run with elevated privileges in the affected deployment configuration.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker who can access the Self-orchestrator REST API can exploit it. No API authentication is required on affected deployments.
What access does successful exploitation provide?
An attacker can use crafted resource identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories. The files they can affect are limited by the filesystem permissions of the Self-orchestrator process.
Are default deployments especially exposed?
The affected deployment configuration increases impact because the container runs with elevated privileges. This can allow the Self-orchestrator process to modify or delete files accessible to those elevated permissions.
How can I determine whether my deployment is affected?
Deployments running a version prior to 1.2.1 are affected if their Self-orchestrator REST API is reachable by an attacker. Version 1.2.1 adds validation and sanitization that prevents path separator characters in identifiers from escaping intended directories.