CVE-2026-92748: BC Security Empire before 6.7.1 Path Traversal File Upload RCE
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Empire operator can exploit it. The attack is network-accessible and requires low privileges, but no user interaction.
Are default deployments affected?
The provided information identifies affected upload endpoints but does not state whether they are enabled or reachable in a default deployment. Any deployment that allows operator access to those endpoints should be considered exposed until updated.
What should be done if an immediate upgrade is not possible?
Restrict operator access to trusted users and limit network access to the Empire server and its upload endpoints. Monitor for upload requests containing path traversal sequences in multipart filenames and investigate unexpected files written outside intended upload locations.
How can administrators check for possible compromise?
Review server files for unexpected or recently created files in sensitive locations outside intended upload directories. Review upload-related logs, if available, for authenticated operator requests with traversal sequences in filename parameters.