CVE-2026-92153: F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to send file-uplink packets to the affected F Prime deployment. Exploitation does not require user interaction, but it does require the low-privilege access represented by the attack vector.
What can an attacker do with a crafted upload packet?
By controlling the StartPacket destinationPath, an attacker can create or overwrite files at filesystem locations writable by the process handling FileUplink. This can compromise integrity and may affect availability.
Are default deployments affected?
The provided information does not identify a default configuration that prevents exploitation. Exposure depends on whether Svc::FileUplink accepts packets from a peer that an attacker can control and on the filesystem permissions of the handling process.
What is the remediation?
Upgrade F Prime to version 4.3.0, which fixes the issue. If upgrading is not immediately possible, restrict access to file-uplink packet submission and limit the FileUplink process to only the filesystem locations it should be able to write.
How can I assess potential impact on a deployment?
Identify whether the deployment uses Svc::FileUplink and whether untrusted or insufficiently trusted peers can send Fw::FilePacket::StartPacket messages. Also review the writable filesystem locations available to the FileUplink-handling process, since those are the locations an attacker could target.