CVE-2026-92604: Scirius through 3.8.0 Arbitrary File Write via PCAP Upload
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the default User role can exploit it. No user interaction is required, and the attack can be performed remotely through the PCAP filestore upload endpoint.
What does an attacker need to control?
The attacker needs to upload a document whose _id field contains path traversal sequences. This lets them escape the intended storage directory and select filesystem paths for JSON files.
What is the impact of a successful exploit?
An attacker can write attacker-controlled JSON content to arbitrary filesystem locations, limited to paths usable with a .json extension. The files are written as root, which can affect integrity and availability.
Are default-role accounts affected?
Yes. The vulnerability explicitly affects users assigned the default User role.